In the Linux kernel, the following vulnerability has been resolved:
spi: fix use-after-free of the add_lock mutex
Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses") introduced a per-controller mutex. But mutex_unlock() of said lock is called after the controller is already freed:
spi_unregister_controller(ctlr) -> put_device(&ctlr->dev) -> spi_controller_release(dev) -> mutex_unlock(&ctrl->add_lock)
Move the put_device() after the mutex_unlock().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade gfs2-kmp-rtUpgrade kernel-azure-develUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade kernel-default-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-rtUpgrade dtb-apmUpgrade dlm-kmp-azureUpgrade dtb-rockchipUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-default-base-rebuildUpgrade kernel-rt-extraUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmallUpgrade kernel-debug-livepatch-develUpgrade kernel-default-extraUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade kernel-sourceUpgrade dtb-marvellUpgrade dtb-nvidiaUpgrade kernel-rt-vdsoUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-rt-optionalUpgrade kernel-azure-vdsoUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-lgUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-qcomUpgrade kernel-source-vanillaUpgrade kernel-obs-qaUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade dtb-xilinxUpgrade cluster-md-kmp-rtUpgrade kernel-default-baseUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-64kbUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-azure-extraUpgrade dtb-alteraUpgrade kernel-default-livepatchUpgrade kernel-defaultUpgrade kernel-docsUpgrade reiserfs-kmp-rtUpgrade dtb-caviumUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade dtb-socionextUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-rtUpgrade dtb-mediatekUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-develUpgrade dtb-amdUpgrade kernel-64kb-extraUpgrade dtb-armUpgrade kernel-64kb-optionalUpgrade kernel-debugUpgrade dtb-freescaleUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-amazonUpgrade kernel-develUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade dtb-apple | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub