In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: fix potential OF node use-after-free
The for_each_child_of_node() helper drops the reference it takes to each node as it iterates over children and an explicit of_node_put() is only needed when exiting the loop early.
Drop the recently introduced bogus additional reference count decrement at each iteration that could potentially lead to a use-after-free.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 6.6.105 | 6.6.107 |
| linux / linux_kernel | 6.12.45 | 6.12.48 |
| linux / linux_kernel | 6.16.5 | 6.16.8 |
| linux / linux_kernel | 6.17-rc4 | 6.17-rc4.x |
| linux / linux_kernel | 6.17-rc5 | 6.17-rc5.x |