CVE-2024-50051

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A vulnerability in the Linux kernel has been resolved. The issue is related to the spi: mpc52xx module, where removing the module could lead to a use-after-free (UAF) bug. This occurs because the ms->work is used while ms is being freed through spi unregister controller. The fix involves adding cancel work sync before module removal to prevent this sequence of operations.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider disabling the removal of the spi: mpc52xx module until a patch is available. Restrict access to the mpc52xx spi remove function to minimize the risk of exploitation. Avoid using the ms->work variable in the affected module until the issue is resolved.