Description
In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0c2b0e747010fa645342138d71339a0ecb823bb0 to < 43e58abad6c08c5f0943594126ef4cd6559aac0baffected33c2e2a87313bc1afe9f7febbbb2014c431a2c5d to < 03bbdaa4da8c6ea0c8431a5011db188a07822c8aaffected8481323710062051b3c42bff94ee5b18a2b496ca to < 75c5d9bce072abbbc09b701a49869ac23c34a906affected8bd518ea03b81eb7b4a734b7b901866c448f6c07 to < 5d3df03f70547d4e3fc10ed4381c052eff51b157affectedcefaad839a384a72331aedad927b1944fb6943dc to < 7501ecfe3e5202490c2d13dc7e181203601fcd69affectedc84117912bddd9e5d87e68daf182410c98181407 to < b4b64fda4d30a83a7f00e92a0c8a1d47699609f3affected21c7c83d592e6335bfb6d65608da3726f976bad4affected5.10.248 to < 5.11affected
Linux Linux
Default version status: unaffected
References
- https://git.kernel.org/stable/c/43e58abad6c08c5f0943594126ef4cd6559aac0b ↗
- https://git.kernel.org/stable/c/03bbdaa4da8c6ea0c8431a5011db188a07822c8a ↗
- https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906 ↗
- https://git.kernel.org/stable/c/5d3df03f70547d4e3fc10ed4381c052eff51b157 ↗
- https://git.kernel.org/stable/c/7501ecfe3e5202490c2d13dc7e181203601fcd69 ↗
- https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 ↗