Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 285a5ea0f542db94c3ed11e01a71abb47d15cbf5 before d1e38551fadea230649bc428f0f35c9ee062a072; affected 285a5ea0f542db94c3ed11e01a71abb47d15cbf5 before 0e7be42ef2490f19d859a6146324d48cafdc9d5c; affected 285a5ea0f542db94c3ed11e01a71abb47d15cbf5 before 38290b180a4d5746baed796d49f88d56d2f336cd |
| Linux / Linux | affected 6.15; unaffected 0 before 6.15; unaffected 6.18.34 through 6.18.*; unaffected 7.0.11 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.