https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:30:11 +0000 https://vulnerability.circl.lu/vuln/cve-2023-53106 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition</p> <p>This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example.</p> <p>In st_nci_i2c_probe, it called ndlc_probe and bound &amp;ndlc-&gt;sm_work with llt_ndlc_sm_work.</p> <p>When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work.</p> <p>When we call st_nci_i2c_remove to remove the driver, there may be a sequence as follows:</p> <p>Fix it by finishing the work before cleanup in ndlc_remove</p> <p>CPU0 CPU1</p> <p>|llt_ndlc_sm_work st_nci_i2c_remove | ndlc_remove | st_nci_remove | nci_free_device| kfree(ndev) | //free ndlc-&gt;ndev | |llt_ndlc_rcv_queue |nci_recv_frame |//use ndlc-&gt;ndev</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition</p> <p>This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example.</p> <p>In st_nci_i2c_probe, it called ndlc_probe and bound &amp;ndlc-&gt;sm_work with llt_ndlc_sm_work.</p> <p>When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work.</p> <p>When we call st_nci_i2c_remove to remove the driver, there may be a sequence as follows:</p> <p>Fix it by finishing the work before cleanup in ndlc_remove</p> <p>CPU0 CPU1</p> <p>|llt_ndlc_sm_work st_nci_i2c_remove | ndlc_remove | st_nci_remove | nci_free_device| kfree(ndev) | //free ndlc-&gt;ndev | |llt_ndlc_rcv_queue |nci_recv_frame |//use ndlc-&gt;ndev</p> https://vulnerability.circl.lu/vuln/cve-2023-53106