net: nfc: llcp: Add lock when modifying device list (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered.
Weaknesses (CWE)
- CWE-667 — Improper Locking
References
- https://git.kernel.org/stable/c/191d87a19cf1005ecf41e1ae08d74e17379e8391
- https://git.kernel.org/stable/c/dba849cc98113b145c6e720122942c00b8012bdb
- https://git.kernel.org/stable/c/4837a192f6d06d5bb2f3f47d6ce5353ab69bf86b
- https://git.kernel.org/stable/c/7562780e32b84196731d57dd24563546fcf6d082
- https://git.kernel.org/stable/c/29c16c2bf5866326d5fbc4a537b3997fcac23391
- https://git.kernel.org/stable/c/dfc7f7a988dad34c3bf4c053124fb26aa6c5f916
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-57149
- GCVE · GCVE-0-2023-52524
CERT-FR advisories
- CERTFR-2025-AVI-0088 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0071 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0458 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0440 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0439 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0422 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0420 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0363 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0329 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.251 < 5.4.258cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.188 < 5.10.198cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.121 < 5.15.135cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.39 < 6.1.57cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.5 < 6.5.7cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected dd6ff3f3862709ab1a12566e73b9d6a9b8f6e548 < 191d87a19cf1005ecf41e1ae08d74e17379e8391 ; affected 96f2c6f272ec04083d828de46285a7d7b17d1aad < dba849cc98113b145c6e720122942c00b8012bdb ; affected fc8429f8d86801f092fbfbd257c3af821ac0dcd3 < 4837a192f6d06d5bb2f3f47d6ce5353ab69bf86b ; affected 425d9d3a92df7d96b3cfb7ee5c240293a21cbde3 < 7562780e32b84196731d57dd24563546fcf6d082 ; affected 6709d4b7bc2e079241fdef15d1160581c5261c10 < 29c16c2bf5866326d5fbc4a537b3997fcac23391 ; affected 6709d4b7bc2e079241fdef15d1160581c5261c10 < dfc7f7a988dad34c3bf4c053124fb26aa6c5f916 |
| Linux · Linux | affected 6.5 ; unaffected 0 < 6.5 ; unaffected 5.4.258 ≤ 5.4.* ; unaffected 5.10.198 ≤ 5.10.* ; unaffected 5.15.135 ≤ 5.15.* ; unaffected 6.1.57 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |