From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5FC8204F93 for ; Wed, 15 Oct 2025 07:58:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760515121; cv=none; b=hRtSz8pJaEKU/0pjATe5C6qztF9x2ECdGZw0ENVtWfBCquQQ37j4rl6++yQS91AIkL5BiAL1rPEuP4DB3qXhXE5wyDsGvvoqgG+k5sBHFPzncR1iOWu2GZf3BevRr+vMADooLLfpRacTfrkI1M1OYkt6vXszgB3mRhgNqChCbWk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760515121; c=relaxed/simple; bh=yf/tvqtUilN71Xe5K1r27lrokBC1ea7G6Ej7qsq3lNY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=A2uZLQcIVpBnXynvBxIsoXIkH1niRL5nZbwBZgnu1UUVM0FKjAm53WbTBXsYHtGCcGeF0QsbKnnA4iY2a4F3XQHfDfEqvIuUgnLGseg37KtYVMZFLH8VO3sM7NcBdamPICmjsyPPQkHrsNKoAzq4GcvjWlTB3XKrCmQIJa/hVYg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bbUBwzm1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bbUBwzm1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 029E1C4CEF8; Wed, 15 Oct 2025 07:58:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1760515121; bh=yf/tvqtUilN71Xe5K1r27lrokBC1ea7G6Ej7qsq3lNY=; h=From:To:Cc:Subject:Date:Reply-to:From; b=bbUBwzm1VSRzLt2PSg73l8ziMexMbN4K6bx/GZnaD0wOeLk7USrM6j6zRBTCieic3 OZQIqruVJreUW+4MUL41QVOqS3vVotXr4fcXLuBXhEUaIbV31XTyePMSRomBprCskh 8z6rLqiu9VSmtwooqNmkHpyxJkZXAS8ilgeRJ2Tw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-39993: media: rc: fix races with imon_disconnect() Date: Wed, 15 Oct 2025 09:58:30 +0200 Message-ID: <2025101527-CVE-2025-39993-caef@gregkh> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5300; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=FDWBf984XPs26WKZmDlbkUrjkusbm2p7jJmyqselRRI=; b=owGbwMvMwCRo6H6F97bub03G02pJDBnvQ5Qt935ekn4/fmHhSb+Im5slRQxUFtxQn3D/44r76 qr75KJ3d8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEVOYwLGh47Pjozi6p+5q7 zRglN6Rc0Ty0l5lhnubUpqMOBiK7pp+PZT83se/ia+NVLwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. The Linux kernel CVE team has assigned CVE-2025-39993 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.35 with commit 21677cfc562a27e099719d413287bc8d1d24deb7 and fixed in 6.6.110 with commit 71da40648741d15b302700b68973fe8b382aef3c Issue introduced in 2.6.35 with commit 21677cfc562a27e099719d413287bc8d1d24deb7 and fixed in 6.12.51 with commit fd5d3e6b149ec8cce045d86a2b5e3664d6b32ba5 Issue introduced in 2.6.35 with commit 21677cfc562a27e099719d413287bc8d1d24deb7 and fixed in 6.16.11 with commit d9f6ce99624a41c3bcb29a8d7d79b800665229dd Issue introduced in 2.6.35 with commit 21677cfc562a27e099719d413287bc8d1d24deb7 and fixed in 6.17.1 with commit 2e7fd93b9cc565b839bc55a6662475718963e156 Issue introduced in 2.6.35 with commit 21677cfc562a27e099719d413287bc8d1d24deb7 and fixed in 6.18-rc1 with commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-39993 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/rc/imon.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/71da40648741d15b302700b68973fe8b382aef3c https://git.kernel.org/stable/c/fd5d3e6b149ec8cce045d86a2b5e3664d6b32ba5 https://git.kernel.org/stable/c/d9f6ce99624a41c3bcb29a8d7d79b800665229dd https://git.kernel.org/stable/c/2e7fd93b9cc565b839bc55a6662475718963e156 https://git.kernel.org/stable/c/fa0f61cc1d828178aa921475a9b786e7fbb65ccb