CVE-2024-49981

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49981
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49981.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49981
Downstream
Related
Published
2024-10-21T18:02:27.142Z
Modified
2026-03-11T07:47:01.560165352Z
Summary
media: venus: fix use after free bug in venus_remove due to race condition
Details

In the Linux kernel, the following vulnerability has been resolved:

media: venus: fix use after free bug in venus_remove due to race condition

in venusprobe, core->work is bound with venussyserrorhandler, which is used to handle error. The code use core->syserrdone to make sync work. The core->work is started in venuseventnotify.

If we call venus_remove, there might be an unfished work. The possible sequence is as follows:

CPU0 CPU1

                 |venus_sys_error_handler

venusremove | hfidestroy | venushfidestroy | kfree(hdev); | |hfireinit |venushfiqueuesreinit |//use hdev

Fix it by canceling the work in venus_remove.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49981.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
af2c3834c8ca7cc65d15592ac671933df8848115
Fixed
5098b9e6377577fe13d03e1d8914930f014a3314
Fixed
63bbe26471ebdcc3c20bb4cc3950d666279ad658
Fixed
60b6968341a6dd5353554f3e72db554693a128a5
Fixed
bf6be32e2d39f6301ff1831e249d32a8744ab28a
Fixed
2a541fcc0bd2b05a458e9613376df1289ec11621
Fixed
b0686aedc5f1343442d044bd64eeac7e7a391f4e
Fixed
d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c
Fixed
10941d4f99a5a34999121b314afcd9c0a1c14f15
Fixed
c5a85ed88e043474161bbfe54002c89c1cb50ee2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49981.json"