NetSight
IP …
high7.8

CVE-2022-48636

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup Fix Oops in dasd_al…

Impact

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL. The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held. Fix by checking the pavgroup pointer with lcu->lock held.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.25 before 4.9.330
from 4.10 before 4.14.295
from 4.15 before 4.19.260
from 4.20 before 5.4.215
from 5.5 before 5.10.146
from 5.11 before 5.15.71

Weakness classification

CWE-476

References