um: Add winch to winch_handlers before registering winch IRQ

Summary

In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list. If that happens, register_winch_irq() adds to that list a winch that is scheduled to be (or has already been) freed, causing a panic later in winch_cleanup(). Avoid the race by adding the winch to the winch_handlers list before registering the IRQ, and rolling back if um_request_irq() fails.

Timeline

1. Jun 24, 2024, 1:52 PM UTCCVE published
2. Jun 24, 2024, 3:15 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 15, 2026, 12:43 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in 66ea9a7c6824821476914bed21a476cd20094f33; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in dc1ff95602ee908fcd7d8acee7a0dadb61b1a0c0; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in 351d1a64544944b44732f6a64ed65573b00b9e14; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in 31960d991e43c8d6dc07245f19fc13398e90ead2; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in 0c02d425a2fbe52643a5859a779db0329e7dddd4; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in 434a06c38ee1217a8baa0dd7c37cc85d50138fb0; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in 73b8e21f76c7dda4905655d2e2c17dc5a73b87f1; From 42a359e31a0e438b5b978a8f0fecdbd3c86bb033 · fixed in a0fbbd36c156b9f7b2276871d499c9943dfe5101

• Linux Linux

  2.6.23

• KernelLinux

  From 2.6.23 · fixed in 4.19.316; From 4.20.0 · fixed in 5.4.278; From 5.5.0 · fixed in 5.10.219; From 5.11.0 · fixed in 5.15.161; From 5.16.0 · fixed in 6.1.93; From 6.2.0 · fixed in 6.6.33; From 6.7.0 · fixed in 6.9.4

References 8