In the Linux kernel, the following vulnerability has been resolved:
spi: lpspi: Avoid potential use-after-free in probe()
fsl_lpspi_probe() is allocating/disposing memory manually with
spi_alloc_host()/spi_alloc_target(), but uses
devm_spi_register_controller(). In case of error after the latter call the
memory will be explicitly freed in the probe function by
spi_controller_put() call, but used afterwards by "devm" management outside
probe() (spi_unregister_controller() <- devm_spi_unregister() below).
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
...
Call trace:
kernfs_find_ns
kernfs_find_and_get_ns
sysfs_remove_group
sysfs_remove_groups
device_remove_attrs
device_del
spi_unregister_controller
devm_spi_unregister
release_nodes
devres_release_all
really_probe
driver_probe_device
__device_attach_driver
bus_for_each_drv
__device_attach
device_initial_probe
bus_probe_device
deferred_probe_work_func
process_one_work
worker_thread
kthread
ret_from_fork
References
Configurations
Configuration 1 (hide)
|
History
27 Jan 2025, 15:08
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| References | () https://git.kernel.org/stable/c/1543418e82789cc383cd36d41469983c64e3fc7f - Patch | |
| References | () https://git.kernel.org/stable/c/2ae0ab0143fcc06190713ed81a6486ed0ad3c861 - Patch | |
| References | () https://git.kernel.org/stable/c/996ce839606afd0fef91355627868022aa73eb68 - Patch | |
| References | () https://git.kernel.org/stable/c/da83ed350e4604b976e94239b08d8e2e7eaee7ea - Patch |
Information
Published : 2024-04-17 11:15
Updated : 2025-01-27 15:08
NVD link : CVE-2024-26866
Mitre link : CVE-2024-26866
CVE.ORG link : CVE-2024-26866
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free