Description
In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() unload module // access to config_desc which freed // while unloading module. cscfg_csdev_enable_config To address this, use cscfg_config_desc's active_cnt as a reference count which will be holded when - activate the config. - enable the activated config. and put the module reference when config_active_cnt == 0.
Product status
f8cce2ff3c04361b8843d8489620fda8880f668b (git) before dfe8224c9c7a43d356eb9f74b06868aa05f90223
f8cce2ff3c04361b8843d8489620fda8880f668b (git) before b3b4efa2e623aecaebd7c9b9e4171f5c659e9724
f8cce2ff3c04361b8843d8489620fda8880f668b (git) before 31028812724cef7bd57a51525ce58a32a6d73b22
f8cce2ff3c04361b8843d8489620fda8880f668b (git) before ed42ee1ed05ff2f4c36938379057413a40c56680
f8cce2ff3c04361b8843d8489620fda8880f668b (git) before 408c97c4a5e0b634dcd15bf8b8808b382e888164
5.15
Any version before 5.15
6.1.142 (semver)
6.6.94 (semver)
6.12.34 (semver)
6.15.3 (semver)
6.16 (original_commit_for_fix)
References
lists.debian.org/debian-lts-announce/2025/10/msg00008.html
git.kernel.org/...c/dfe8224c9c7a43d356eb9f74b06868aa05f90223
git.kernel.org/...c/b3b4efa2e623aecaebd7c9b9e4171f5c659e9724
git.kernel.org/...c/31028812724cef7bd57a51525ce58a32a6d73b22
git.kernel.org/...c/ed42ee1ed05ff2f4c36938379057413a40c56680
git.kernel.org/...c/408c97c4a5e0b634dcd15bf8b8808b382e888164