In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From t…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its device was being used by iotcl() on another thread. Once the last fd refcnt is released, vhci_release() calls hci_unregister_dev(), hci_free_dev(), and kfree() for struct vhci_data, which is set to hci_dev->dev->driver_data. The problem …
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/0e5c144c557df910ab64d9c25d06399a9a735e65 Patch
- https://git.kernel.org/stable/c/1d6123102e9fbedc8d25bf4731da6d513173e49e Patch
- https://git.kernel.org/stable/c/90dee0a0ff84fac8accd5be98412b3819f667149
- https://git.kernel.org/stable/c/bc0819a25e04cd68ef3568cfa51b63118fea39a7 Patch
- https://git.kernel.org/stable/c/c56b177efce8b62798e4d96bdb9867106cb7c4a0
- https://git.kernel.org/stable/c/ce23b73f0f27e2dbeb81734a79db710f05aa33c6 Patch
- https://git.kernel.org/stable/c/dd4becd3fd4102696e1c15e6d260a1712a2d8685
Timeline
- nvd_ingest NVD