Description
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix URB leak in pvr2_send_request_ex When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb(). Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < da524c939b1e5ba17f10db4bde4bdaf569ffcda6affectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < cf459d6ffa5e150ef3744b897f936ff24b52bd15affectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < 77a63f8efc434ddb04667ed632aade58301a2f13affectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < 4ba5c7a1aade7090172cbffd4d120bf4cf5ccbdeaffectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < 58dd722b6c3debcddb4684fb256c90fee7f063e5affectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < 2011929f0e4cf6a0a34dd6205911b12276904453affectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < 5f3ac816861c3b8a5d1a3645b17dc3a99d668d94affectedd855497edbfbf9e19a17f4a1154bca69cb4bd9ba to < a8333c8262aed2aedf608c18edd39cf5342680a7affected
Linux Linux
Default version status: affected
2.6.18affected0 to < 2.6.18unaffected5.10.252 to ≤ 5.10.*unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.16 to ≤ 6.18.*unaffected6.19.6 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6 ↗
- https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15 ↗
- https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13 ↗
- https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde ↗
- https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5 ↗
- https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453 ↗
- https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94 ↗
- https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7 ↗