CVE-2024-49981

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49981
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49981.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49981
Downstream
Related
Published
2024-10-21T18:02:27.142Z
Modified
2026-05-28T03:53:03.477248982Z
Summary
media: venus: fix use after free bug in venus_remove due to race condition
Details

In the Linux kernel, the following vulnerability has been resolved:

media: venus: fix use after free bug in venus_remove due to race condition

in venusprobe, core->work is bound with venussyserrorhandler, which is used to handle error. The code use core->syserrdone to make sync work. The core->work is started in venuseventnotify.

If we call venus_remove, there might be an unfished work. The possible sequence is as follows:

CPU0 CPU1

                 |venus_sys_error_handler

venusremove | hfidestroy | venushfidestroy | kfree(hdev); | |hfireinit |venushfiqueuesreinit |//use hdev

Fix it by canceling the work in venus_remove.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49981.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
af2c3834c8ca7cc65d15592ac671933df8848115
Fixed
5098b9e6377577fe13d03e1d8914930f014a3314
Fixed
63bbe26471ebdcc3c20bb4cc3950d666279ad658
Fixed
60b6968341a6dd5353554f3e72db554693a128a5
Fixed
bf6be32e2d39f6301ff1831e249d32a8744ab28a
Fixed
2a541fcc0bd2b05a458e9613376df1289ec11621
Fixed
b0686aedc5f1343442d044bd64eeac7e7a391f4e
Fixed
d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c
Fixed
10941d4f99a5a34999121b314afcd9c0a1c14f15
Fixed
c5a85ed88e043474161bbfe54002c89c1cb50ee2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49981.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.13.0
Fixed
4.19.323
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.285
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.227
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.168
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.113
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.55
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.14
Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.11.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49981.json"