staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume() ipu7_resume() calls pm_runtime_get_sync() before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without dropping the reference. Use pm_runtime_resume_and_get() instead, which balances the usage count on failure and avoids the leak. Keep returning 0 on error, as resume callbacks should not propagate failures to the PM core, matching the behaviour of the ipu6 driver.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 · fixed in 593fda71983b9c23c84a566b20c53dc402c6b376; From b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 · fixed in 437d6d15936db87485afabf7d52754b7b19cc787; From b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 · fixed in b298b80814dd0fc3cb1c8c0e0082fc14fdb5fecf
- Linux Linux
6.17
- KernelLinux
From 6.17.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6