In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr. If we remove the driver which will call emac_remove to make cleanup, there may be a unfinished work. This could lead to a use-after-free. Upstream fix: https://github.com/torvalds/linux/commit/6b6bc5b8bd2d
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2192669]
This was fixed for Fedora with the 6.2.9 stable kernel updates.
Here is the credit Information: Zheng Wang(@xmzyshypnc), Zhuorao Yang(@A1ex), Yang Hu(@BlueSheep) and Zong Cao(@P1umer)
CVE-2023-2483 was rejected as duplicate of CVE-2023-33203. See https://nvd.nist.gov/vuln/detail/CVE-2023-2483 for more details. Updating bug summary accordingly.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6901 https://access.redhat.com/errata/RHSA-2023:6901
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7077 https://access.redhat.com/errata/RHSA-2023:7077
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0412 https://access.redhat.com/errata/RHSA-2024:0412
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:0575 https://access.redhat.com/errata/RHSA-2024:0575