https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 03:55:15 +0000 https://cve.radiocsirt.org/vuln/cve-2025-37838 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition</p> <p>In the ssi_protocol_probe() function, &amp;ssi-&gt;work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work.</p> <p>If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi-&gt;cl; | // use ssi</p> <p>Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition</p> <p>In the ssi_protocol_probe() function, &amp;ssi-&gt;work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work.</p> <p>If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi-&gt;cl; | // use ssi</p> <p>Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove().</p> https://cve.radiocsirt.org/vuln/cve-2025-37838