CVE-2024-35887

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ax25: fix use-after-free bugs caused by ax25_ds_del_timer<br /> <br /> When the ax25 device is detaching, the ax25_dev_device_down()<br /> calls ax25_ds_del_timer() to cleanup the slave_timer. When<br /> the timer handler is running, the ax25_ds_del_timer() that<br /> calls del_timer() in it will return directly. As a result,<br /> the use-after-free bugs could happen, one of the scenarios<br /> is shown below:<br /> <br /> (Thread 1) | (Thread 2)<br /> | ax25_ds_timeout()<br /> ax25_dev_device_down() |<br /> ax25_ds_del_timer() |<br /> del_timer() |<br /> ax25_dev_put() //FREE |<br /> | ax25_dev-&gt; //USE<br /> <br /> In order to mitigate bugs, when the device is detaching, use<br /> timer_shutdown_sync() to stop the timer.