https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 09:30:23 +0000 https://cve.radiocsirt.org/vuln/cve-2024-50059 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition</p> <p>In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &amp;sndev-&gt;check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work.</p> <p>If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| check_link_status_work switchtec_ntb_remove | kfree(sndev); | | if (sndev-&gt;link_force_down) | // use sndev</p> <p>Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition</p> <p>In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &amp;sndev-&gt;check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work.</p> <p>If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| check_link_status_work switchtec_ntb_remove | kfree(sndev); | | if (sndev-&gt;link_force_down) | // use sndev</p> <p>Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.</p> https://cve.radiocsirt.org/vuln/cve-2024-50059