ieee802154/adf7242: defer destroy_workqueue call (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks. To fix this, we can add a flag write at the beginning of adf7242_remove and add flag check in adf7242_channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") which let the ieee802154_unregister_hw() to handle the synchronization. This patch takes the second option. runs")
Weaknesses (CWE)
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/dede80aaf01f4b6e8657d23726cb4a3da226ec4c
- https://git.kernel.org/stable/c/bed12d7531df1417fc92c691999ff95e03835008
- https://git.kernel.org/stable/c/23a29932715ca43bceb2eae1bdb770995afe7271
- https://git.kernel.org/stable/c/9f8558c5c642c62c450c98c99b7d18a709fff485
- https://git.kernel.org/stable/c/15f3b89bd521d5770d36a61fc04a77c293138ba6
- https://git.kernel.org/stable/c/afe7116f6d3b888778ed6d95e3cf724767b9aedf
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | MEDIUM 4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-55249
- GCVE · GCVE-0-2022-49968
CERT-FR advisories
- CERTFR-2026-AVI-0081 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0649 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0607 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0587 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.17.19 < 4.18cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.18.1 < 4.19.258cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.213cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.142cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.66cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 5.19.8cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.18:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.18:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.18:rc8:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 58e9683d14752debc6f22daf6b23e031787df31f < dede80aaf01f4b6e8657d23726cb4a3da226ec4c ; affected 58e9683d14752debc6f22daf6b23e031787df31f < bed12d7531df1417fc92c691999ff95e03835008 ; affected 58e9683d14752debc6f22daf6b23e031787df31f < 23a29932715ca43bceb2eae1bdb770995afe7271 ; affected 58e9683d14752debc6f22daf6b23e031787df31f < 9f8558c5c642c62c450c98c99b7d18a709fff485 ; affected 58e9683d14752debc6f22daf6b23e031787df31f < 15f3b89bd521d5770d36a61fc04a77c293138ba6 ; affected 58e9683d14752debc6f22daf6b23e031787df31f < afe7116f6d3b888778ed6d95e3cf724767b9aedf |
| Linux · Linux | affected 4.18 ; unaffected 0 < 4.18 ; unaffected 4.19.258 ≤ 4.19.* ; unaffected 5.4.213 ≤ 5.4.* ; unaffected 5.10.142 ≤ 5.10.* ; unaffected 5.15.66 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |