CVE-2026-53380
HIGH
7.8
CVSS 3.1
Description
In the Linux kernel, the following vulnerability has been resolved:
media: rzv2h-ivc: Fix concurrent buffer list access
The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a
spinlock (`rzv2h_ivc::buffers.lock`). However, in
`rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the
`list_del()` call is executed without holding the spinlock, which makes
it possible for the list to be concurrently modified
Fix that by removing a buffer from the list in the lock protected section.
[assign ivc->buffers.curr in critical section as reported by Barnabas]
Metadata
Severity & Metrics
7.8
HIGH CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products (2)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Linux | Linux | — | f0b3984d821b3a603cd8786dca6cc73d47c4521a < c746522bd3264132ab2e2382e96e19cdb8a6c1ba, f0b3984d821b3a603cd8786dca6cc73d47c4521a < 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 |
| Linux | Linux | — | 6.19, 0 < 6.19, 7.0.9 ≤ 7.0.*, 7.1 ≤ * |
CVSS scores (1)
| Score | Severity | Version | Source | Vector |
|---|---|---|---|---|
| 7.8 | HIGH | 3.1 | cna | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
References (2)