https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 07:11:14 +0000 https://cve.radiocsirt.org/vuln/cve-2024-26654 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs</p> <p>The dreamcastcard-&gt;timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard-&gt;timer.</p> <p>When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below:</p> <p>(Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard-&gt;channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard-&gt;channel-&gt; //USE</p> <p>In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs</p> <p>The dreamcastcard-&gt;timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard-&gt;timer.</p> <p>When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below:</p> <p>(Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard-&gt;channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard-&gt;channel-&gt; //USE</p> <p>In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed.</p> https://cve.radiocsirt.org/vuln/cve-2024-26654