In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: em28xx: defer audio-only extension registration<\/p>\n
The audio-only path registers extensions while probing the primary device.
\nFor a dual-TS board, this happens before dev_next is created. The duplicate
\ndevice inherits is_audio_only and is then independently inserted into
\nem28xx_devlist.<\/p>\n
The list is intended to contain only primary devices: extension operations
\nreach the secondary device through dev_next. The independently linked
\nsecondary can be freed during disconnect while its list node remains
\nreachable, resulting in a use-after-free.<\/p>\n
Defer audio-only extension registration to the module-request work item. It
\nruns only after probing has completed construction of the optional
\nsecondary device, so only the primary is registered and extension callbacks
\nreach the secondary through dev_next.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: em28xx: defer audio-only extension registration<\/p>\n
The audio-only path registers extensions while probing the primary device.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24579","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}