Описание
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
After device_initialize(), the embedded struct device in struct
host1x_device should be released through the device core with
put_device().
In host1x_device_add(), if host1x_device_parse_dt() fails, the current
error path frees the object directly with kfree(device). That bypasses
the normal device lifetime handling and leaks the reference held on the
embedded struct device.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fix this by using put_device() in the host1x_device_parse_dt() failure
path.
A flaw was found in the Linux kernel's gpu: host1x subsystem. An error handling path in the host1x_device_parse_dt() function, when called from host1x_device_add(), fails to properly release a device reference. This oversight leads to a device reference leak, which could potentially result in resource exhaustion and a Denial of Service (DoS) over an extended period.
Отчет
A low impact flaw was found in the Linux kernel's gpu host1x subsystem. In host1x_device_add(), the error path taken when host1x_device_parse_dt() fails frees the host1x device object directly with kfree() instead of releasing it through the device core with put_device(), bypassing the normal struct device lifetime handling and leaking the reference held on the embedded struct device. Exploiting this flaw requires local access with sufficient privileges to trigger the host1x device initialization error path, and each occurrence only leaks a small amount of resources; repeated triggering over an extended period could accumulate leaked references, leading to resource exhaustion and a denial of service. There is no impact on confidentiality or integrity. This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2. For these products the fix is currently deferred because this is a low severity resource leak on a device initialization error path with limited practical exploitability; the residual risk of leaving it unfixed is gradual local resource exhaustion on systems where the error path can be triggered repeatedly. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. While the CVSS:3.1 base score for this flaw is 5.5 (Moderate), Red Hat's overall severity assessment is low because reliable exploitation requires privileged local control over device initialization and repeated deliberate triggering to accumulate a meaningful resource leak.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the host1x_device_parse_dt() failure path.
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the host1x_device_parse_dt() failure path.
In the Linux kernel, the following vulnerability has been resolved: g ...
EPSS
5.5 Medium
CVSS3