Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < d91d253c87fd1efece521ff2612078a35af673c6affected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < 7f25f296fc9bd0435be14e89bf657cd615a23574affected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < 94ee7ff99b87435ec63211f632918dc7f44dac79affected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < 557d035fe88d78dd51664f4dc0e1896c04c97cf6affected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < dc8074b8901caabb97c2d353abd6b4e7fa5a59a5affected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < ff5bbbdee08287d75d72e65b72a2b76d9637892aaffected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < ee39384ee787e86e9db4efb843818ef0ea9cb8aeaffected59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 to < aee2424246f9f1dadc33faa78990c1e2eb7826e4affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected4.19.320 to ≤ 4.19.*unaffected5.4.282 to ≤ 5.4.*unaffected5.10.224 to ≤ 5.10.*unaffected5.15.165 to ≤ 5.15.*unaffected6.1.103 to ≤ 6.1.*unaffected6.6.44 to ≤ 6.6.*unaffected6.10.3 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d91d253c87fd1efece521ff2612078a35af673c6 ↗
- https://git.kernel.org/stable/c/7f25f296fc9bd0435be14e89bf657cd615a23574 ↗
- https://git.kernel.org/stable/c/94ee7ff99b87435ec63211f632918dc7f44dac79 ↗
- https://git.kernel.org/stable/c/557d035fe88d78dd51664f4dc0e1896c04c97cf6 ↗
- https://git.kernel.org/stable/c/dc8074b8901caabb97c2d353abd6b4e7fa5a59a5 ↗
- https://git.kernel.org/stable/c/ff5bbbdee08287d75d72e65b72a2b76d9637892a ↗
- https://git.kernel.org/stable/c/ee39384ee787e86e9db4efb843818ef0ea9cb8ae ↗
- https://git.kernel.org/stable/c/aee2424246f9f1dadc33faa78990c1e2eb7826e4 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html ↗