NetSight
IP …
high7.8

CVE-2024-26872

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Do not register event handler until srpt device is fully setup Upon rare occasio…

Impact

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Do not register event handler until srpt device is fully setup Upon rare occasions, KASAN reports a use-after-free Write in srpt_refresh_port(). This seems to be because an event handler is registered before the srpt device is fully setup and a race condition upon error may leave a partially setup event handler in place. Instead, only register the event handler after srpt device initialization is complete.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.3 before 5.10.214
from 5.11 before 5.15.153
from 5.16 before 6.1.83
from 6.2 before 6.6.23
from 6.7 before 6.7.11
from 6.8 before 6.8.2
DebianDebian Linux
Version 10.0

Weakness classification

CWE-416

References