From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B40F316915 for ; Fri, 19 Sep 2025 15:28:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758295694; cv=none; b=QX59dePeZgAXVf3JyQH/jvvw0ke7eurV1cDFwdHRDtoUzMxDpSWUCkUsHZ3FrMip6/fy1r5Sr2rL2BMaP+Y8s5bODVEkOetZjYowY6+SvDsXnAHnK1K4RcNVy03vC/d0zjCk955qN84qUTXRPHWb9IcsyoBvf36LLcFM2L6eMM4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758295694; c=relaxed/simple; bh=iJtXrj0/RzXTFVA4xko9QvJd56da3GsZq2axPabzIto=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fWKUhdvGpXCwjuGaQbr0SDkzEEn3GrFaz29O5MJ8y8o0fAHt0b/hnDR2TncmXAIxgAvLF0bSlPCnYMZOLIhf9yezfRSR0Ei6E9tvZzCV38EIFsqf+47/FVnjaxNjDk6tdgq98vplru8nrzxgR0MzOIwUr4i48n078J5TGmHKMdM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TpO2bsIf; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TpO2bsIf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8D88C4CEF0; Fri, 19 Sep 2025 15:28:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1758295694; bh=iJtXrj0/RzXTFVA4xko9QvJd56da3GsZq2axPabzIto=; h=From:To:Cc:Subject:Date:Reply-to:From; b=TpO2bsIf/0FcAmMn6DMSQ6U96bsb11gwzMAmaKQQDwBC/yYwefRdHxSuarb9AxFsY MzrEf/j7oigNAl0zcEBl6hodwMnanC1goof6+7aeFwoIdk8+pRyufwSq4TS46A/wrS 28evlDSDe04dZvvMS9sji077tLhghFfozYM3ttiQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-39837: platform/x86: asus-wmi: Fix racy registrations Date: Fri, 19 Sep 2025 17:28:01 +0200 Message-ID: <2025091902-CVE-2025-39837-eec6@gregkh> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2263; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=VVe3saq0MzrOteSLiBN3I/XTNXOI6kH/3kduTHRH3pc=; b=owGbwMvMwCRo6H6F97bub03G02pJDBlny5r29GvHl3avvKVyLunLqUYBzbXPw6dnHj252ar66 ZOEGfwLOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAihssZFiyvcvn8/EeJweGv grF663kzvN9xRDIs2BJsNO3e8o2Xfr/svC3F9G5ddlWyDgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be called from multiple drivers concurrently, which can lead to the racy list operations, eventually corrupting the memory and hitting Oops on some ASUS machines. Also, the error handling is missing, and it forgot to unregister ACPI lps0 dev ops in the error case. This patch covers those issues by introducing a simple mutex at acpi_wmi_register_driver() & *_unregister_driver, and adding the proper call of asus_s2idle_check_unregister() in the error path. The Linux kernel CVE team has assigned CVE-2025-39837 to this issue. Affected and fixed versions =========================== Issue introduced in 6.16 with commit feea7bd6b02d43a794e3f065650d89cf8d8e8e59 and fixed in 6.16.6 with commit e7a70326fb26b905cfc8fe2366113aa4394733ef Issue introduced in 6.16 with commit feea7bd6b02d43a794e3f065650d89cf8d8e8e59 and fixed in 6.17-rc5 with commit 5549202b9c02c2ecbc8634768a3da8d9e82d548d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-39837 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/platform/x86/asus-wmi.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e7a70326fb26b905cfc8fe2366113aa4394733ef https://git.kernel.org/stable/c/5549202b9c02c2ecbc8634768a3da8d9e82d548d