staging: nvec: fix use-after-free in nvec_rx_completed()

Summary

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.

Timeline

1. Aug 15, 2026, 5:57 AM UTCCVE published
2. Aug 17, 2026, 5:44 AM UTCRecord last updated

Affected versions

• Linux Linux

  Version range not reported

• Linux Linux

  3.2

References 8