spi: fix use-after-free on controller registration failure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free on controller registration failure Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 · fixed in 0e23f50086da7d0b183dfeac26021acfcdee086b; From 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 · fixed in 6bbd385b30c7fb6c7ee0669e9ada91490938c051; From 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 · fixed in afe27c1f43aa57530011f419be6ddf71306565d2; From 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 · fixed in 80f3e8cd2b4ad355b2ad2024cf423f6d183404f7; From 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 · fixed in 23b51bad2eb8787aa74324cfccefb258515ae5ba; From 6598b91b5ac32bc756d7c3000a31f775d4ead1c4 · fixed in 8634e05b08ead636e926022f4a98416e13440df9
- Linux Linux
6.0
- KernelLinux
From 6.0.0 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.130; From 6.7.0 · fixed in 6.12.78; From 6.13.0 · fixed in 6.18.20; From 6.19.0 · fixed in 6.19.10