Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. So the release of the dma channel leads to the following issue: [ 4.879000] st,stm32-spdifrx 500d0000.audio-controller: dma_request_slave_channel error -19 [ 4.888975] Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dma_release_channel+0x24/0x100 [ 5.103235] stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx] [ 5.109494] stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx] To avoid this issue, release channel only if the pointer is valid.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
794df9448edb55978e50372f083aeedade1b2844 to < 3a977b554f668382dfba31fd62e4cce4fe5643dbaffected794df9448edb55978e50372f083aeedade1b2844 to < 0d75f887aabd80cf37ea48d28f159afa7850ea28affected794df9448edb55978e50372f083aeedade1b2844 to < 4f1d74f74752eab8af6b8b28797dc6490d57374caffected794df9448edb55978e50372f083aeedade1b2844 to < 23bdbd1ef3e063e03d3c50c15a591b005ebbae39affected794df9448edb55978e50372f083aeedade1b2844 to < 22ae9321054cf7f36c537702af133659f51a0b88affected794df9448edb55978e50372f083aeedade1b2844 to < 9bb4af400c386374ab1047df44c508512c08c31faffected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.230 to ≤ 5.10.*unaffected5.15.172 to ≤ 5.15.*unaffected6.1.117 to ≤ 6.1.*unaffected6.6.61 to ≤ 6.6.*unaffected6.11.8 to ≤ 6.11.*unaffected6.12 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3a977b554f668382dfba31fd62e4cce4fe5643db ↗
- https://git.kernel.org/stable/c/0d75f887aabd80cf37ea48d28f159afa7850ea28 ↗
- https://git.kernel.org/stable/c/4f1d74f74752eab8af6b8b28797dc6490d57374c ↗
- https://git.kernel.org/stable/c/23bdbd1ef3e063e03d3c50c15a591b005ebbae39 ↗
- https://git.kernel.org/stable/c/22ae9321054cf7f36c537702af133659f51a0b88 ↗
- https://git.kernel.org/stable/c/9bb4af400c386374ab1047df44c508512c08c31f ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗