Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory. Cancel it at the top of iio_trig_release(), which every free path reaches through the device core's final put_device(). Found by an in-house static analysis tool.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 9020ef659885f2622cfb386cc229b6d618362895 before ac5d26a46c90ff61fd574eff4e8f0d71c905828a; affected 9020ef659885f2622cfb386cc229b6d618362895 before cf513df1a2c75566cdc802d9da47f62e8d6cfd18; affected 9020ef659885f2622cfb386cc229b6d618362895 before e64703280ce7a23a43c27efebeb7da457c88bf5c; affected 9020ef659885f2622cfb386cc229b6d618362895 before 882d0011c59ff8ac15188ec9ce071399ecfa10ad; affected 9020ef659885f2622cfb386cc229b6d618362895 before 2a57b9246cecd5dd797a42eb310d6c8816f26d9e; affected a18aeac73c0f692ba40964f5f56e182312ae843b; affected 2c5c948451d57596640b20887b06b523d376eb24; affected 5.15.17 before 5.16; affected 5.16.3 before 5.17 |
| Linux / Linux | affected 5.17; unaffected 0 before 5.17; unaffected 6.6.160 through 6.6.*; unaffected 6.12.113 through 6.12.*; unaffected 6.18.56 through 6.18.*; unaffected 7.2.10 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/ac5d26a46c90ff61fd574eff4e8f0d71c905828a
- https://git.kernel.org/stable/c/cf513df1a2c75566cdc802d9da47f62e8d6cfd18
- https://git.kernel.org/stable/c/e64703280ce7a23a43c27efebeb7da457c88bf5c
- https://git.kernel.org/stable/c/882d0011c59ff8ac15188ec9ce071399ecfa10ad
- https://git.kernel.org/stable/c/2a57b9246cecd5dd797a42eb310d6c8816f26d9e