CVE-2026-53380
Description
In the Linux kernel, the following vulnerability has been resolved:
media: rzv2h-ivc: Fix concurrent buffer list access
The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a
spinlock (`rzv2h_ivc::buffers.lock`). However, in
`rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the
`list_del()` call is executed without holding the spinlock, which makes
it possible for the list to be concurrently modified
Fix that by removing a buffer from the list in the lock protected section.
[assign ivc->buffers.curr in critical section as reported by Barnabas]
Metadata
Severity & Metrics
No CVSS data available.
Affected products (2)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Linux | Linux | — | f0b3984d821b3a603cd8786dca6cc73d47c4521a < c746522bd3264132ab2e2382e96e19cdb8a6c1ba, f0b3984d821b3a603cd8786dca6cc73d47c4521a < 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 |
| Linux | Linux | — | 6.19, 0 < 6.19, 7.0.9 ≤ 7.0.*, 7.1 ≤ * |
References (2)