Executive brief
A vulnerability exists in the Linux kernel's iMON driver, which manages certain infrared remote control and display devices. When one of these devices is unplugged while the system is still trying to send data to it, the system may attempt to access memory that has already been freed. This can lead to a system crash or potentially allow a local user to gain unauthorized control over the system.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/media/rc/imon.c due to improper synchronization between imon_disconnect() and active writer paths like vfd_write() and lcd_write(). The driver unconditionally releases the usb_device reference count via usb_put_dev() during disconnection without checking if other threads are still accessing the device context. A local attacker can trigger this race condition by disconnecting the device while a write operation is in progress, leading to a KASAN-detected UAF in send_packet() or __create_pipe(). The fix involves implementing proper locking and checking a 'disconnected' flag in all writer paths to ensure early exit before the USB core performs cleanup.
Affected products
- Linux Linux Kernel 21677cfc562a to 9348976003e3, 21677cfc562a to b03fac6e2a38, 21677cfc562a to 71c52b073922, 21677cfc562a to 71096a6161a2, 21677cfc562a to 71da40648741
Timeline
- 2025-07-29: other: Patch authored
- 2025-10-15: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/2e7fd93b9cc565b839bc55a6662475718963e156
- https://git.kernel.org/stable/c/71096a6161a25e84acddb89a9d77f138502d26ab
- https://git.kernel.org/stable/c/71c52b073922d05e79e6de7fc7f5f38f927929a4
- https://git.kernel.org/stable/c/71da40648741d15b302700b68973fe8b382aef3c
- https://git.kernel.org/stable/c/9348976003e39754af344949579e824a0a210fc4
- https://git.kernel.org/stable/c/b03fac6e2a38331faf8510b480becfa90cea1c9f
- https://git.kernel.org/stable/c/d9f6ce99624a41c3bcb29a8d7d79b800665229dd