CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's UIO (Userspace I/O) subsystem, where a race condition can occur during the device registration process. If a device setup fails after being added, it may leave a pointer to freed memory accessible to userspace, potentially leading to memory corruption and exploitation. Organizations using Linux systems that rely on UIO should prioritize addressing this issue to mitigate risks associated with unsafe memory access.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().