Описание
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: anx7411 - stop the IRQ before destroying the workqueue
The IRQ is devm-managed, so it can still queue plat->work while
remove() is tearing the queue down. Disable it first.
A flaw was found in the Linux kernel's ANX7411 USB Type-C driver. This flaw allows a Denial of Service (DoS) due to a race condition during device removal. Because an interrupt request (IRQ) remains active while the driver destroys its work queue, an incoming interrupt during teardown can trigger a system crash.
Отчет
A lifecycle race in the anx7411 Type C driver allows the devm managed IRQ to queue plat work while anx7411_i2c_remove() is cancelling work and destroying the associated workqueue. A late interrupt can therefore submit work through a stale workqueue pointer, creating a potential use-after-free that may corrupt workqueue state or crash the kernel. Reliable triggering requires an IRQ to occur inside the narrow driver teardown window, so the attack complexity is high. For the CVSS the PR:L value is used for the paranoid score because a locally constrained user may be able to influence Type C activity or operate through delegated device management while teardown is initiated by another system component. The normal administrative unbind path instead supports PR:H for the base score. The issue is not network reachable, although a connected Type C or USB PD device may influence interrupt timing. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to potential use-after-free memory corruption.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. Disable it first.
In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. Disable it first.
usb: typec: anx7411 - stop the IRQ before destroying the workqueue
In the Linux kernel, the following vulnerability has been resolved: u ...
In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat->work while remove() is tearing the queue down. Disable it first.
EPSS
4.7 Medium
CVSS3