In the Linux kernel, the following vulnerability has been resolved: media: rzv2h-ivc: Fix concurrent buffer list access The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a spinlock (`rzv2h_ivc::buffers.lock`). However, in `rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the `list_del()` call is executed without holding the spinlock, which makes it possible for the list to be concurrently modified Fix that by removing a buffer from the list in the lock protected section. [assign ivc->buffers.curr in critical section as reported by Barnabas]
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Linux | Linux | 6.19CNA affecteddefault affected | |
| Linux | Linux | >= f0b3984d821b3a603cd8786dca6cc73d47c4521a, < 72773ff1cdfaebc593f53b1719b2c1773ecf8c43, >= f0b3984d821b3a603cd8786dca6cc73d47c4521a, < c746522bd3264132ab2e2382e96e19cdb8a6c1baCNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.