Description
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e5be15c63804e05b5a94197524023702a259e308 to < ec36c134dd020d28e312c2f1766f85525e747aabaffectede5be15c63804e05b5a94197524023702a259e308 to < 47aa8fcd5e8b5563af4042a00f25ba89bef8f33daffectede5be15c63804e05b5a94197524023702a259e308 to < 3233d8bf7893550045682192cb227af7fa3defebaffectede5be15c63804e05b5a94197524023702a259e308 to < ec3634ebe23fc3c44ebc67c6d25917300bc68c08affectede5be15c63804e05b5a94197524023702a259e308 to < 30773ea47d41773f9611ffb4ebc9bda9d19a9e7eaffectede5be15c63804e05b5a94197524023702a259e308 to < 2cf0005d315549b8d2b940ff96a66c2a889aa795affectede5be15c63804e05b5a94197524023702a259e308 to < 437b5f57732bb4cc32cc9f8895d2010ee9ff521caffectede5be15c63804e05b5a94197524023702a259e308 to < ded85b0c0edd8f45fec88783d7555a5b982449c1affected
Linux Linux
Default version status: affected
2.6.26affected0 to < 2.6.26unaffected4.19.306 to ≤ 4.19.*unaffected5.4.268 to ≤ 5.4.*unaffected5.10.209 to ≤ 5.10.*unaffected5.15.148 to ≤ 5.15.*unaffected6.1.75 to ≤ 6.1.*unaffected6.6.14 to ≤ 6.6.*unaffected6.7.2 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab ↗
- https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d ↗
- https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb ↗
- https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 ↗
- https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e ↗
- https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 ↗
- https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c ↗
- https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗