usb: renesas_usbhs: fix use-after-free in ISR during device removal
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
|||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions | ||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux Kernel |
|
||||||||||||||||||||||||||||||||||||||||||||
| Linux | Linux Kernel |
|
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4606-1 | linux security update |
Ubuntu USN |
USN-8567-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8574-1 | Linux kernel (GCP FIPS) vulnerabilities |
Ubuntu USN |
USN-8575-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8576-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
Ubuntu USN |
USN-8574-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8595-1 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-8596-1 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8575-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8576-2 | Linux kernel (NVIDIA Tegra) vulnerabilities |
Ubuntu USN |
USN-8575-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8595-2 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-8606-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8607-1 | Linux kernel (Azure CVM) vulnerabilities |
Ubuntu USN |
USN-8608-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-8609-1 | Linux kernel (Azure CVM) vulnerabilities |
Ubuntu USN |
USN-8610-1 | Linux kernel (Azure CVM) vulnerabilities |
Ubuntu USN |
USN-8574-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8595-3 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-8619-1 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-8620-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8620-2 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-8620-3 | Linux kernel (Intel IoTG) vulnerabilities |
Ubuntu USN |
USN-8620-4 | Linux kernel (Intel IoTG) vulnerabilities |
Ubuntu USN |
USN-8665-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-8668-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8668-2 | Linux kernel (Raspberry Pi) vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.126% probability within 30 days)
Key SSVC decision points have not yet been added.
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-364 | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: fix use-after-free in ISR during device removal In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free. Fix this by calling devm_free_irq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhs_pipe_remove() is called. | |
| Title | usb: renesas_usbhs: fix use-after-free in ISR during device removal | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|