In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq27xxx: Fix poll_interval handling and races on remove
Before this patch bq27xxxbatteryteardown() was setting pollinterval = 0 to avoid bq27xxxbatteryupdate() requeuing the delayedwork item.
There are 2 problems with this:
If the driver is unbound through sysfs, rather then the module being rmmod-ed, this changes poll_interval unexpectedly
This is racy, after it being set pollinterval could be changed before bq27xxxbatteryupdate() checks it through /sys/module/bq27xxxbattery/parameters/poll_interval
Fix this by added a removed attribute to struct bq27xxxdeviceinfo and using that instead of setting poll_interval to 0.
There also is another pollinterval related race on remove(), writing /sys/module/bq27xxxbattery/parameters/pollinterval will requeue the delayedwork item for all devices on the bq27xxxbatterydevices list and the device being removed was only removed from that list after cancelling the delayed_work item.
Fix this by moving the removal from the bq27xxxbatterydevices list to before cancelling the delayed_work item.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54079.json",
"cna_assigner": "Linux"
}