Description

In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read. Read the revision before dropping the reference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:11.900Z",
  "pubdate": "2026-09-03T13:06:11.900Z",
  "executiveSummary": "A use-after-free vulnerability has been identified in the Linux kernel within the pata_sl82c105 ATA controller driver. This flaw is triggered by an incorrect sequence of operations involving PCI device reference counting. The vulnerability manifests when the driver attempts to access the PCI device's revision field after the reference count has been released via pci_dev_put().\nAn attacker capable of triggering this code path—typically through device initialization or hot-plug sequences—could potentially cause a kernel panic, resulting in a denial-of-service (DoS) condition. While primary impact is system instability, use-after-free vulnerabilities in kernel memory can theoretically lead to arbitrary code execution or privilege escalation if an attacker can control the contents of the freed memory slab before it is accessed by the driver. This issue affects Linux kernel versions where the driver accesses the cached revision field post-reference release.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper reference counting lifecycle management within the pata_sl82c105 driver. The function pci_get_slot() increments the reference count of the pci_dev structure, signifying that the caller has acquired a valid reference to the PCI bridge device. Historically, drivers performed direct configuration-space reads to retrieve the device revision. However, following the transition to accessing the cached pci_device->revision field, the driver logic failed to maintain the required object lifetime scope.\nIn the vulnerable implementation, the driver performs the following operations: 1) Acquires a reference to the bridge device using pci_get_slot(). 2) Releases the reference count using pci_dev_put(). 3) Attempts to read the pci_device->revision field. By invoking pci_dev_put() before reading the revision field, the kernel's PCI subsystem is permitted to deallocate the pci_dev structure and reclaim the associated memory if no other references exist. If the memory is freed, the subsequent access to the revision field becomes a use-after-free violation.\nExploitation involves the race window between the execution of pci_dev_put() and the access of the stale pci_dev pointer. If a slab allocator reuses the memory previously occupied by the pci_dev struct for another kernel object, the driver will perform a read operation on attacker-controlled or otherwise corrupted data. This results in the kernel reading an arbitrary or unintended value from the new object, which can lead to unpredictable kernel behavior, memory corruption, or logical bypasses in the ATA initialization phase. Given that the ATA driver is responsible for hardware communication, triggering this vulnerability during system boot or device hot-plugging can lead to a system hang or kernel oops. The vulnerability does not require network exposure but requires local access to trigger hardware-related driver functions, making it a critical concern for systems supporting hot-plug PCI hardware."
}