CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's firmware component, specifically in the arm_ffa subsystem, where snapshot notifier callbacks can lead to a use-after-free condition due to improper handling of locks during callback execution. This flaw allows for potential exploitation, resulting in arbitrary code execution or system crashes, making it critical for organizations relying on Linux systems to prioritize patching. System administrators and security teams should address this vulnerability immediately to mitigate risks associated with concurrent unregister operations.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.