In the Linux kernel, the following vulnerability has been resolved:
spi: fix use-after-free of the add_lock mutex
Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses") introduced a per-controller mutex. But mutex_unlock() of said lock is called after the controller is already freed:
spi_unregister_controller(ctlr) -> put_device(&ctlr->dev) -> spi_controller_release(dev) -> mutex_unlock(&ctrl->add_lock)
Move the put_device() after the mutex_unlock().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kselftests-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-default-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade dtb-exynosUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade dtb-rockchipUpgrade kernel-rt-optionalUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade dtb-qcomUpgrade dtb-sprdUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-debug-vdsoUpgrade dtb-nvidiaUpgrade kernel-sourceUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade reiserfs-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-obs-qaUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade kernel-syms-azureUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rtUpgrade dtb-apmUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade dtb-renesasUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-default-optionalUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade dtb-alteraUpgrade dtb-socionextUpgrade dtb-hisiliconUpgrade kernel-64kbUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade kernel-zfcpdumpUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-devel-rtUpgrade dtb-xilinxUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-freescaleUpgrade gfs2-kmp-defaultUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-default-baseUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-debugUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade dtb-amdUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade kernel-default-devel | Aug 9, 2024 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub