Description
In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.
Product status
f9010dbdce911ee1f1af1398a24b1f9f992e0080 (git) before 82a1463c968b1a6ae598a4f2fcef17b71bb7d3a0
f9010dbdce911ee1f1af1398a24b1f9f992e0080 (git) before d2be773a92874a070215b51b730cb2b1eaa8fae2
f9010dbdce911ee1f1af1398a24b1f9f992e0080 (git) before 7ce635b3d3aba43296b62b5a2d97c008bc51cbd2
f9010dbdce911ee1f1af1398a24b1f9f992e0080 (git) before afe16653e05db07d658b55245c7a2e0603f136c0
6.4
Any version before 6.4
6.6.109 (semver)
6.12.50 (semver)
6.16.10 (semver)
6.17 (original_commit_for_fix)
References
git.kernel.org/...c/82a1463c968b1a6ae598a4f2fcef17b71bb7d3a0
git.kernel.org/...c/d2be773a92874a070215b51b730cb2b1eaa8fae2
git.kernel.org/...c/7ce635b3d3aba43296b62b5a2d97c008bc51cbd2
git.kernel.org/...c/afe16653e05db07d658b55245c7a2e0603f136c0
