Riskcovery

CVE-2021-47195

spi: fix use-after-free of the add_lock mutex

State
Published
Severity
Not scored
Published
Apr 10, 2024
Updated
May 23, 2026
Reserved
Mar 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: fix use-after-free of the add_lock mutex

Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses") introduced a per-controller mutex. But mutex_unlock() of said lock is called after the controller is already freed:

spi_unregister_controller(ctlr) -> put_device(&ctlr->dev) -> spi_controller_release(dev) -> mutex_unlock(&ctrl->add_lock)

Move the put_device() after the mutex_unlock().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • aa3f3d7bef59583f2d3234173105a27ff61ef8fe to before 54c2c96eafcfd242e52e932ab54ace4784efe1ddAffected
  • c8dce228db6f81dbc897a018dfc5c418e917cf64 to before 11eab327a2a8bd36c38afbff920ae1bd45588dd4Affected
  • 6098475d4cb48d821bdf453c61118c56e26294f0 to before 37330f37f6666c7739a44b2b6b95b047ccdbed2dAffected
  • 6098475d4cb48d821bdf453c61118c56e26294f0 to before 6c53b45c71b4920b5e62f0ea8079a1da382b9434Affected
  • 722ef19a161ce3fffb3d1b01ce2301c306639bddAffected
  • 5.14.15 to before 5.15Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.5 through 5.15.*Not affected
  • 5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.