In the Linux kernel, the following vulnerability has been resolved:
media: venus: fix use after free bug in venus_remove due to race condition
in venusprobe, core->work is bound with venussyserrorhandler, which is used to handle error. The code use core->syserrdone to make sync work. The core->work is started in venuseventnotify.
If we call venus_remove, there might be an unfished work. The possible sequence is as follows:
CPU0 CPU1
                 |venus_sys_error_handler
venusremove | hfidestroy | venushfidestroy | kfree(hdev); | |hfireinit |venushfiqueuesreinit |//use hdev
Fix it by canceling the work in venus_remove.
[
    {
        "digest": {
            "line_hashes": [
                "322475467545539910065187797095549636181",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5098b9e6377577fe13d03e1d8914930f014a3314",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-23543d6f",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "240712644245004444104321185994793027814",
            "length": 538.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60b6968341a6dd5353554f3e72db554693a128a5",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-23d93ac4",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "240712644245004444104321185994793027814",
            "length": 538.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a541fcc0bd2b05a458e9613376df1289ec11621",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-2de17813",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a85ed88e043474161bbfe54002c89c1cb50ee2",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-33834088",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "317703858383521593026287299533889795234",
            "length": 525.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0686aedc5f1343442d044bd64eeac7e7a391f4e",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-39345e3e",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-5e98abd7",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "317703858383521593026287299533889795234",
            "length": 525.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a85ed88e043474161bbfe54002c89c1cb50ee2",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-60521592",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a541fcc0bd2b05a458e9613376df1289ec11621",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-656ac1e8",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "301893111459401609111001101401602193080",
            "length": 376.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63bbe26471ebdcc3c20bb4cc3950d666279ad658",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-6f1da3a3",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0686aedc5f1343442d044bd64eeac7e7a391f4e",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-7249882e",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10941d4f99a5a34999121b314afcd9c0a1c14f15",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-7f27836b",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf6be32e2d39f6301ff1831e249d32a8744ab28a",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-8c54be67",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "249881706033382388549090454370243512124",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60b6968341a6dd5353554f3e72db554693a128a5",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-998fdd6a",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "240712644245004444104321185994793027814",
            "length": 538.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf6be32e2d39f6301ff1831e249d32a8744ab28a",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-9a2c3f50",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "8927710135629233577452579142893175934",
            "length": 357.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5098b9e6377577fe13d03e1d8914930f014a3314",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-9c9310ca",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "317703858383521593026287299533889795234",
            "length": 525.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10941d4f99a5a34999121b314afcd9c0a1c14f15",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-a57eb06c",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "317703858383521593026287299533889795234",
            "length": 525.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c",
        "target": {
            "function": "venus_remove",
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-a5bc3b46",
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "322475467545539910065187797095549636181",
                "300417750883971263352840512350035483542",
                "144225455795002805788209515951661076372"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63bbe26471ebdcc3c20bb4cc3950d666279ad658",
        "target": {
            "file": "drivers/media/platform/qcom/venus/core.c"
        },
        "id": "CVE-2024-49981-ab82e9bf",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false
    }
]