In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: i2c: ov7740: fix use-after-destroy in remove<\/p>\n
The ov7740_remove() function had a severe teardown order bug where it
\ndestroyed the driver’s mutex before freeing the V4L2 control handler
\nwhich relies on that mutex, leading to a use-after-destroy kernel panic.
\nFurthermore, the driver explicitly called v4l2_ctrl_handler_free() and
\nmutex_destroy() sequentially, but then called ov7740_free_controls()
\nwhich invokes both of them a second time, resulting in a double-free.<\/p>\n
This patch fixes the issue by unregistering the subdevice first, and
\nrelying exclusively on ov7740_free_controls() to safely tear down the
\nmutex and control handler in the correct order.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: i2c: ov7740: fix use-after-destroy in remove<\/p>\n
The ov7740_remove() function had a severe teardown order bug where it
\ndestroye<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24574","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}