coresight: holding cscfg_csdev_lock while removing cscfg from csdev (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 13 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible race scenario for coresight config: CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) iterating config_csdev_list could be raced with config_csdev_list's entry delete. To resolve this race , hold csdev->cscfg_csdev_lock() while cscfg_remove_owned_csdev_configs()
Références
- https://git.kernel.org/stable/c/18a3a21c39cca593762aa90f322bd74c18ec59d4
- https://git.kernel.org/stable/c/1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7
- https://git.kernel.org/stable/c/8f16b9caf0bdba46044e1d3727ee78291aa36347
- https://git.kernel.org/stable/c/42f8afb0b161631fd1d814d017f75f955475ad41
- https://git.kernel.org/stable/c/53b9e2659719b04f5ba7593f2af0f2335f75e94a
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-19811
- GCVE · GCVE-0-2025-38132
Avis du CERT-FR
- CERTFR-2025-AVI-0859 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0843 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0828 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0759 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0745 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0723 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17 < 6.15.3
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 02bd588e12df405bdf55244708151b7f238b79ba < 18a3a21c39cca593762aa90f322bd74c18ec59d4 ; affected 02bd588e12df405bdf55244708151b7f238b79ba < 1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7 ; affected 02bd588e12df405bdf55244708151b7f238b79ba < 8f16b9caf0bdba46044e1d3727ee78291aa36347 ; affected 02bd588e12df405bdf55244708151b7f238b79ba < 42f8afb0b161631fd1d814d017f75f955475ad41 ; affected 02bd588e12df405bdf55244708151b7f238b79ba < 53b9e2659719b04f5ba7593f2af0f2335f75e94a |
| Linux · Linux | affected 5.17 ; unaffected 0 < 5.17 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.15.3 ≤ 6.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |