# CVEs published 2024-04-28 44 CVEs were published on April 28, 2024: 1 critical, 14 high. Days are UTC. - [CVE-2022-48668](https://cve.now/CVE-2022-48668.md): smb3: fix temporary data corruption in collapse range (no CVSS, Linux) - [CVE-2022-48667](https://cve.now/CVE-2022-48667.md): smb3: fix temporary data corruption in insert range (no CVSS, Linux) - [CVE-2022-48666](https://cve.now/CVE-2022-48666.md): scsi: core: Fix a use-after-free (CVSS 9.8, Linux) - [CVE-2022-48665](https://cve.now/CVE-2022-48665.md): exfat: fix overflow for large capacity partition (CVSS 7.1, Linux) - [CVE-2022-48664](https://cve.now/CVE-2022-48664.md): btrfs: fix hang during unmount when stopping a space reclaim worker (no CVSS, Linux) - [CVE-2022-48663](https://cve.now/CVE-2022-48663.md): gpio: mockup: fix NULL pointer dereference when removing debugfs (no CVSS, Linux) - [CVE-2022-48662](https://cve.now/CVE-2022-48662.md): drm/i915/gem: Really move i915\_gem\_context.link under ref protection (CVSS 7.8, Linux) - [CVE-2022-48661](https://cve.now/CVE-2022-48661.md): gpio: mockup: Fix potential resource leakage when register a chip (no CVSS, Linux) - [CVE-2022-48660](https://cve.now/CVE-2022-48660.md): gpiolib: cdev: Set lineevent\_state::irq after IRQ register successfully (CVSS 5.5, Linux) - [CVE-2022-48659](https://cve.now/CVE-2022-48659.md): mm/slub: fix to return errno if kmalloc() fails (no CVSS, Linux) - [CVE-2022-48658](https://cve.now/CVE-2022-48658.md): mm: slub: fix flush\_cpu\_slab()/\_\_free\_slab() invocations in task context. (CVSS 7.5, Linux) - [CVE-2022-48657](https://cve.now/CVE-2022-48657.md): arm64: topology: fix possible overflow in amu\_fie\_setup() (no CVSS, Linux) - [CVE-2022-48656](https://cve.now/CVE-2022-48656.md): dmaengine: ti: k3-udma-private: Fix refcount leak bug in of\_xudma\_dev\_get() (no CVSS, Linux) - [CVE-2022-48655](https://cve.now/CVE-2022-48655.md): firmware: arm\_scmi: Harden accesses to the reset domains (CVSS 8.1, Linux) - [CVE-2022-48654](https://cve.now/CVE-2022-48654.md): netfilter: nfnetlink\_osf: fix possible bogus match in nf\_osf\_find() (CVSS 7.1, Linux) - [CVE-2022-48653](https://cve.now/CVE-2022-48653.md): ice: Don't double unplug aux on peer initiated reset (no CVSS, Linux) - [CVE-2022-48652](https://cve.now/CVE-2022-48652.md): ice: Fix crash by keep old cfg when update TCs more than queues (CVSS 8.8, Linux) - [CVE-2022-48651](https://cve.now/CVE-2022-48651.md): ipvlan: Fix out-of-bound bugs caused by unset skb-\>mac\_header (CVSS 7.7, Linux) - [CVE-2022-48650](https://cve.now/CVE-2022-48650.md): scsi: qla2xxx: Fix memory leak in \_\_qlt\_24xx\_handle\_abts() (CVSS 4.7, Linux) - [CVE-2022-48649](https://cve.now/CVE-2022-48649.md): mm/slab\_common: fix possible double free of kmem\_cache (no CVSS, Linux) - [CVE-2022-48648](https://cve.now/CVE-2022-48648.md): sfc: fix null pointer dereference in efx\_hard\_start\_xmit (no CVSS, Linux) - [CVE-2022-48647](https://cve.now/CVE-2022-48647.md): sfc: fix TX channel offset when using legacy interrupts (no CVSS, Linux) - [CVE-2022-48646](https://cve.now/CVE-2022-48646.md): sfc/siena: fix null pointer dereference in efx\_hard\_start\_xmit (CVSS 6.2, Linux) - [CVE-2022-48645](https://cve.now/CVE-2022-48645.md): net: enetc: deny offload of tc-based TSN features on VF interfaces (no CVSS, Linux) - [CVE-2022-48644](https://cve.now/CVE-2022-48644.md): net/sched: taprio: avoid disabling offload when it was never enabled (no CVSS, Linux) - [CVE-2022-48643](https://cve.now/CVE-2022-48643.md): netfilter: nf\_tables: fix nft\_counters\_enabled underflow at nf\_tables\_addchain() (no CVSS, Linux) - [CVE-2022-48642](https://cve.now/CVE-2022-48642.md): netfilter: nf\_tables: fix percpu memory leak at nf\_tables\_addchain() (no CVSS, Linux) - [CVE-2022-48641](https://cve.now/CVE-2022-48641.md): netfilter: ebtables: fix memory leak when blob is malformed (no CVSS, Linux) - [CVE-2022-48640](https://cve.now/CVE-2022-48640.md): bonding: fix NULL deref in bond\_rr\_gen\_slave\_id (no CVSS, Linux) - [CVE-2022-48639](https://cve.now/CVE-2022-48639.md): net: sched: fix possible refcount leak in tc\_new\_tfilter() (no CVSS, Linux) - [CVE-2022-48638](https://cve.now/CVE-2022-48638.md): cgroup: cgroup\_get\_from\_id() must check the looked-up kn is a directory (CVSS 5.3, Linux) - [CVE-2022-48637](https://cve.now/CVE-2022-48637.md): bnxt: prevent skb UAF after handing over to PTP worker (CVSS 7.8, Linux) - [CVE-2022-48636](https://cve.now/CVE-2022-48636.md): s390/dasd: fix Oops in dasd\_alias\_get\_start\_dev due to missing pavgroup (CVSS 7.8, Linux) - [CVE-2022-48635](https://cve.now/CVE-2022-48635.md): fsdax: Fix infinite loop in dax\_iomap\_rw() (CVSS 6.2, Linux) - [CVE-2022-48634](https://cve.now/CVE-2022-48634.md): drm/gma500: Fix BUG: sleeping function called from invalid context errors (CVSS 5.3, Linux) - [CVE-2022-48633](https://cve.now/CVE-2022-48633.md): drm/gma500: Fix WARN\_ON(lock-\>magic != lock) error (no CVSS, Linux) - [CVE-2022-48632](https://cve.now/CVE-2022-48632.md): i2c: mlxbf: prevent stack overflow in mlxbf\_i2c\_smbus\_start\_transaction() (CVSS 7.8, Linux) - [CVE-2022-48631](https://cve.now/CVE-2022-48631.md): ext4: fix bug in extents parsing when eh\_entries == 0 and eh\_depth \> 0 (no CVSS, Linux) - [CVE-2024-25050](https://cve.now/CVE-2024-25050.md): IBM i privilege escalation (CVSS 8.4, IBM i ยท IBM Rational Development Studio for i) - [CVE-2024-26928](https://cve.now/CVE-2024-26928.md): smb: client: fix potential UAF in cifs\_debug\_files\_proc\_show() (no CVSS, Linux) - [CVE-2024-26927](https://cve.now/CVE-2024-26927.md): ASoC: SOF: Add some bounds checking to firmware data (CVSS 8.4, Linux) - [CVE-2024-33883](https://cve.now/CVE-2024-33883.md): The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. (CVSS 4.0, ejs) - [CVE-2024-33891](https://cve.now/CVE-2024-33891.md): Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService (CVSS 8.8) - [CVE-2024-33899](https://cve.now/CVE-2024-33899.md): RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI (CVSS 7.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-04-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.