In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipmi: Fix user refcount underflow in event delivery<\/p>\n
ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the
\nreceive message, and ipmi_free_recv_msg() drops it again. If event delivery
\nfails after allocating receive messages for earlier users,
\nhandle_read_event_rsp() rolls those messages back with
\nipmi_free_recv_msg().<\/p>\n
That rollback path still drops user->refcount explicitly after freeing each
\nmessage. The extra put can free a user that remains linked on intf->users,
\nso later event delivery may dereference a freed user or trip refcount_t’s
\naddition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire
\nanother reference.<\/p>\n
Remove the stale explicit put and the now-dead user assignment. Keep the
\nlist_del() and ipmi_free_recv_msg() calls; they are the required rollback
\noperations.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipmi: Fix user refcount underflow in event delivery<\/p>\n
ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the
\nrece<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6742","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}