https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:16:40 +0000 https://vulnerability.circl.lu/vuln/cve-2023-52617 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>PCI: switchtec: Fix stdev_release() crash after surprise hot remove</p> <p>A PCI device hot removal may occur while stdev-&gt;cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return.</p> <p>At that later point in time, the devm cleanup has already removed the stdev-&gt;mmio_mrpc mapping. Also, the stdev-&gt;pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &amp;stdev-&gt;pdev-&gt;dev pointer.</p> <p>Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev-&gt;pdev ref is now optional, but may prevent future accidents.</p> <p>Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>PCI: switchtec: Fix stdev_release() crash after surprise hot remove</p> <p>A PCI device hot removal may occur while stdev-&gt;cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return.</p> <p>At that later point in time, the devm cleanup has already removed the stdev-&gt;mmio_mrpc mapping. Also, the stdev-&gt;pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &amp;stdev-&gt;pdev-&gt;dev pointer.</p> <p>Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev-&gt;pdev ref is now optional, but may prevent future accidents.</p> <p>Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com</p> https://vulnerability.circl.lu/vuln/cve-2023-52617