Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: intel_th: fix MSC output device reference leak intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected af4b9467296b9a16ebc008147238070236982b6d before 12ad4fad748e6e563ff4480f03b89134a41b5c37; affected 64015cbf06e8bb75b81ae95b997e847b55280f7f before df55842fddbcdb80e6dd16680439c0f780ed592e; affected b71e64ef7ff9443835d1333e3e80ab1e49e5209f before 141641a70ed337e54487f766ede745fc2ce44c42; affected bf7785434b5d05d940d936b78925080950bd54dd before ddcf2064d7ec5a8c9afa7cb74442320e443502bc; affected 0fca16c5591534cc1fec8b6181277ee3a3d0f26c before 26e27b8dcef1e4df6f30d8f25b3304a506d482b3; affected f9b059bda4276f2bb72cb98ec7875a747f042ea2 before caba30eb8bd321c465ecfc7d850ee85f5b353496; affected 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 before c3a28f9cb82425fe0835048ed3677f321e780691; affected 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 before 761b785a0cfbce43761227bc42a7f984f31f8921; affected 5.10.249 before 5.10.265; affected 5.15.199 before 5.15.216; affected 6.1.162 before 6.1.183; affected 6.6.122 before 6.6.148; affected 6.12.68 before 6.12.101; affected 6.18.8 before 6.18.42 |
| Linux / Linux | affected 6.19; unaffected 0 before 6.19; unaffected 5.10.265 through 5.10.*; unaffected 5.15.216 through 5.15.*; unaffected 6.1.183 through 6.1.*; unaffected 6.6.148 through 6.6.*; unaffected 6.12.101 through 6.12.*; unaffected 6.18.42 through 6.18.*; unaffected 7.1.6 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/12ad4fad748e6e563ff4480f03b89134a41b5c37
- https://git.kernel.org/stable/c/df55842fddbcdb80e6dd16680439c0f780ed592e
- https://git.kernel.org/stable/c/141641a70ed337e54487f766ede745fc2ce44c42
- https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc
- https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3
- https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496
- https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691
- https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921