Description
In the Linux kernel, the following vulnerability has been resolved: comedi: Flush partial mappings in error case If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error path. Fix it by explicitly flushing all mappings in our VMA on the error path. See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case").
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to < 57f048c2d205b85e34282a9b0b0ae177e84c2f44affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < b9322408d83accc8b96322bc7356593206288c56affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 8797b7712de704dc231f9e821d8eb3b9aeb3a032affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 16c507df509113c037cdc0ba642b9ab3389bd26caffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 9b07fb464eb69a752406e78e62ab3a60bfa7b00daffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < c6963a06ce5c61d3238751ada04ee1569663a828affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 297f14fbb81895f4ccdb0ad25d196786d6461e00affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < ce8f9fb651fac95dd41f69afe54d935420b945bdaffected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.4.287 to ≤ 5.4.*unaffected5.10.231 to ≤ 5.10.*unaffected5.15.174 to ≤ 5.15.*unaffected6.1.120 to ≤ 6.1.*unaffected6.6.64 to ≤ 6.6.*unaffected6.11.11 to ≤ 6.11.*unaffected6.12.2 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/57f048c2d205b85e34282a9b0b0ae177e84c2f44 ↗
- https://git.kernel.org/stable/c/b9322408d83accc8b96322bc7356593206288c56 ↗
- https://git.kernel.org/stable/c/8797b7712de704dc231f9e821d8eb3b9aeb3a032 ↗
- https://git.kernel.org/stable/c/16c507df509113c037cdc0ba642b9ab3389bd26c ↗
- https://git.kernel.org/stable/c/9b07fb464eb69a752406e78e62ab3a60bfa7b00d ↗
- https://git.kernel.org/stable/c/c6963a06ce5c61d3238751ada04ee1569663a828 ↗
- https://git.kernel.org/stable/c/297f14fbb81895f4ccdb0ad25d196786d6461e00 ↗
- https://git.kernel.org/stable/c/ce8f9fb651fac95dd41f69afe54d935420b945bd ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html ↗