CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's cx23885 driver, where the netup_ci_exit() function can free a netup_ci_state while a related work item may still be executing, leading to potential use-after-free conditions. This could allow an attacker to exploit the race condition, potentially leading to system instability or arbitrary code execution. Organizations utilizing Linux systems with the cx23885 driver should prioritize addressing this vulnerability to mitigate risks associated with kernel-level exploits.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool.