Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free(). The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9cf671d60fdbeb8f875859c11148cf13c326ada2 to < 847103369489110a222482c7781e0fe62cdbd3d5affected9cf671d60fdbeb8f875859c11148cf13c326ada2 to < c422d5d53f135ea987f745773953a91f9fe30c3faffected9cf671d60fdbeb8f875859c11148cf13c326ada2 to < 6ec5bf430cf7466cb412e47f2761594092781facaffected9cf671d60fdbeb8f875859c11148cf13c326ada2 to < 3456c5bcc987aeb182e50e30c9b02be8420e9953affected9cf671d60fdbeb8f875859c11148cf13c326ada2 to < 2c79d7a7b583050c9f58041465cb46fe3483ab5daffected
Linux Linux
Default version status: affected
5.12affected0 to < 5.12unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/847103369489110a222482c7781e0fe62cdbd3d5 ↗
- https://git.kernel.org/stable/c/c422d5d53f135ea987f745773953a91f9fe30c3f ↗
- https://git.kernel.org/stable/c/6ec5bf430cf7466cb412e47f2761594092781fac ↗
- https://git.kernel.org/stable/c/3456c5bcc987aeb182e50e30c9b02be8420e9953 ↗
- https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d ↗