Description
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix device_node use after free At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- iterates over channels * automatically gets 'channel' * tegra_csi_channel_alloc() * saves into chan->of_node a pointer to the channel OF node * automatically gets and puts 'channel' * now the node saved in chan->of_node has refcount 0, can disappear * tegra_csi_channels_init * iterates over channels * tegra_csi_channel_init -- uses chan->of_node After that, chan->of_node keeps storing the node until the device is removed. of_node_get() the node and of_node_put() it during teardown to avoid any risk.
Product status
1ebaeb09830f36c1111b72a95420814225bd761c (git) before 5451efb2ca30f3c42b9efb8327ce35b62870dbd3
1ebaeb09830f36c1111b72a95420814225bd761c (git) before ce50c612458091d926ccb05d7db11d9f93532db2
1ebaeb09830f36c1111b72a95420814225bd761c (git) before 6512c9498fcb97e7c760e3ef86b2272f2c0f765f
1ebaeb09830f36c1111b72a95420814225bd761c (git) before 0fd003d3c708c80350a815eaf37b8e1114b976cf
1ebaeb09830f36c1111b72a95420814225bd761c (git) before c4d344163c3a7f90712525f931a6c016bbb35e18
5.10
Any version before 5.10
5.10.163 (semver)
5.15.87 (semver)
6.0.18 (semver)
6.1.4 (semver)
6.2 (original_commit_for_fix)
References
git.kernel.org/...c/5451efb2ca30f3c42b9efb8327ce35b62870dbd3
git.kernel.org/...c/ce50c612458091d926ccb05d7db11d9f93532db2
git.kernel.org/...c/6512c9498fcb97e7c760e3ef86b2272f2c0f765f
git.kernel.org/...c/0fd003d3c708c80350a815eaf37b8e1114b976cf
git.kernel.org/...c/c4d344163c3a7f90712525f931a6c016bbb35e18
Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.
