In the Linux kernel, the following vulnerability has been resolved:
drm/shmem-helper: Remove another errant put in error path
drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 5.9.5 | 5.10 |
| linux / linux_kernel | 5.10.1 | 5.10.176 |
| linux / linux_kernel | 5.11 | 5.15.104 |
| linux / linux_kernel | 5.16 | 6.1.21 |
| linux / linux_kernel | 6.2 | 6.2.8 |
| linux / linux_kernel | 5.10 | 5.10.x |
| linux / linux_kernel | 5.10-rc2 | 5.10-rc2.x |
| linux / linux_kernel | 5.10-rc3 | 5.10-rc3.x |
| linux / linux_kernel | 5.10-rc4 | 5.10-rc4.x |
| linux / linux_kernel | 5.10-rc5 | 5.10-rc5.x |
| linux / linux_kernel | 5.10-rc6 | 5.10-rc6.x |
| linux / linux_kernel | 5.10-rc7 | 5.10-rc7.x |
| linux / linux_kernel | 6.3-rc1 | 6.3-rc1.x |
| linux / linux_kernel | 6.3-rc2 | 6.3-rc2.x |