Description
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close the window by exposing tty->disc_data only on the success path, when opening of the NCI device and try_module_get() succeeds. The code differs in error path in one aspect: tty->disc_data won't be ever assigned thus NULL-ified. This however should not be relevant difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < a514fca2b8e95838a3ba600f31a18fa60b76d893affected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < 000bfbc6bc334a93fffca8f5aa9583e7b6356cb5affected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < ac6992f72bd8e22679c1e147ac214de6a7093c23affected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < dc7722619a9c307e9938d735cf4a2210d3d48dcbaffected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < a8acc7080ad55c5402a1b818b3008998247dda87affected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < 55c3dbd8389636161090a2b2b6d2d709b9602e9caffected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < e9799db771b2d574d5bf0dfb3177485e5f40d4d6affected9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 to < fc27ab48904ceb7e4792f0c400f1ef175edf16feaffected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.4.295 to ≤ 5.4.*unaffected5.10.239 to ≤ 5.10.*unaffected5.15.186 to ≤ 5.15.*unaffected6.1.142 to ≤ 6.1.*unaffected6.6.95 to ≤ 6.6.*unaffected6.12.35 to ≤ 6.12.*unaffected6.15.4 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a514fca2b8e95838a3ba600f31a18fa60b76d893 ↗
- https://git.kernel.org/stable/c/000bfbc6bc334a93fffca8f5aa9583e7b6356cb5 ↗
- https://git.kernel.org/stable/c/ac6992f72bd8e22679c1e147ac214de6a7093c23 ↗
- https://git.kernel.org/stable/c/dc7722619a9c307e9938d735cf4a2210d3d48dcb ↗
- https://git.kernel.org/stable/c/a8acc7080ad55c5402a1b818b3008998247dda87 ↗
- https://git.kernel.org/stable/c/55c3dbd8389636161090a2b2b6d2d709b9602e9c ↗
- https://git.kernel.org/stable/c/e9799db771b2d574d5bf0dfb3177485e5f40d4d6 ↗
- https://git.kernel.org/stable/c/fc27ab48904ceb7e4792f0c400f1ef175edf16fe ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗