High · published June 24, 2024
In the Linux kernel, the following vulnerability has been resolved:
um: Add winch to winch_handlers before registering winch IRQ
Registering a winch IRQ is racy, an interrupt may occur before the winch is
added to the winch_handlers list.
If that happens, register_winch_irq() adds to that list a winch that is
scheduled to be (or has already been) freed, causing a panic later in
winch_cleanup().
Avoid the race by adding the winch to the winch_handlers list before
registering the IRQ, and rolling back if um_request_irq() fails.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 2.6.23 | 2.6.23 |
| linux/linux_kernel | ≥ 4.19, < 4.19.316 | 4.19.316 |
| linux/linux_kernel | ≥ 5.4, < 5.4.278 | 5.4.278 |
| linux/linux_kernel | ≥ 5.10, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.15, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 6.1, < 6.1.93 | 6.1.93 |
| linux/linux_kernel | ≥ 6.6, < 6.6.33 | 6.6.33 |
| linux/linux_kernel | ≥ 6.9, < 6.9.4 | 6.9.4 |
| linux/linux_kernel | all versions | — |