Description
In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76_disconnect The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6affected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < 6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33faffected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < 3c619aec1f538333b56746d2f796aab1bca5c9a5affected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < 5e7df74745700f059dc117a620e566964a2e8f2caffected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < 7ca513631fa6ad3011b8b9197cdde0f351103704affected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < a9682bfef2cf3802515a902e964d774e137be1b9affected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < 152721cbae42713ecfbca6847e0f102ee6b19546affected29e20aa6c6aff35c81d4da2e2cd516dadb569061 to < 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7daaffected
Linux Linux
Default version status: affected
3.17affected0 to < 3.17unaffected5.4.293 to ≤ 5.4.*unaffected5.10.237 to ≤ 5.10.*unaffected5.15.181 to ≤ 5.15.*unaffected6.1.135 to ≤ 6.1.*unaffected6.6.88 to ≤ 6.6.*unaffected6.12.25 to ≤ 6.12.*unaffected6.14.4 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6 ↗
- https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f ↗
- https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5 ↗
- https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c ↗
- https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704 ↗
- https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9 ↗
- https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546 ↗
- https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗