CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the gpib (General Purpose Interface Bus) subsystem, where a flaw in the command_ioctl() function can lead to a use-after-free condition due to improper management of the descriptor_busy reference counter. This can allow a concurrent close_dev_ioctl() operation to free an actively-used descriptor, potentially leading to system instability or exploitation. Organizations using Linux systems that rely on gpib functionality should prioritize addressing this issue to mitigate risks associated with this flaw.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor_busy in command_ioctl() commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1. This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it. Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl().