Description
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7359d482eb4d3967cc8be354405ae6be6eaf732c to < 82cc242da6d621752718929e6a2fa6f9554ebffeaffected7359d482eb4d3967cc8be354405ae6be6eaf732c to < 441be312fce927443eae2821f502344d953c38bbaffected7359d482eb4d3967cc8be354405ae6be6eaf732c to < 4333174ea52c863a50bb3e0a4726bf9f7cdf7524affected7359d482eb4d3967cc8be354405ae6be6eaf732c to < 79ba37dd38a321cb32a79332a3e3c68dd334dca9affected7359d482eb4d3967cc8be354405ae6be6eaf732c to < fd772af9512cdecb83de34a461801533828e77fdaffected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/82cc242da6d621752718929e6a2fa6f9554ebffe ↗
- https://git.kernel.org/stable/c/441be312fce927443eae2821f502344d953c38bb ↗
- https://git.kernel.org/stable/c/4333174ea52c863a50bb3e0a4726bf9f7cdf7524 ↗
- https://git.kernel.org/stable/c/79ba37dd38a321cb32a79332a3e3c68dd334dca9 ↗
- https://git.kernel.org/stable/c/fd772af9512cdecb83de34a461801533828e77fd ↗