Description
In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when the ring is being stopped. Depending on timing between ring stop request completion, interrupt handler removal and code execution this may lead to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run after the io_data pointer is set to NULL in hci_dma_cleanup(). Prevent this my masking the ring interrupts before ring stop request.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to < a6cddf68b3405b272b5a3cad9657be0b02b34bf4affected3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to < 9d745a56aea45e47f4755bc12e6429d6314dbb54affected3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to < a6dc4b4fda2e147e557050eaae51ff15edeb680baffected3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to < 19cc5767334bfe980f52421627d0826c0da86721affected3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to < 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.66 to ≤ 6.6.*unaffected6.12.5 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a6cddf68b3405b272b5a3cad9657be0b02b34bf4 ↗
- https://git.kernel.org/stable/c/9d745a56aea45e47f4755bc12e6429d6314dbb54 ↗
- https://git.kernel.org/stable/c/a6dc4b4fda2e147e557050eaae51ff15edeb680b ↗
- https://git.kernel.org/stable/c/19cc5767334bfe980f52421627d0826c0da86721 ↗
- https://git.kernel.org/stable/c/6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗