{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcp251xfd: fix infinite loop when xmit fails\n\nWhen the mcp251xfd_start_xmit() function fails, the driver stops\nprocessing messages, and the interrupt routine does not return,\nrunning indefinitely even after killing the running application.\n\nError messages:\n[  441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16\n[  441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).\n... and repeat forever.\n\nThe issue can be triggered when multiple devices share the same SPI\ninterface. And there is concurrent access to the bus.\n\nThe problem occurs because tx_ring->head increments even if\nmcp251xfd_start_xmit() fails. Consequently, the driver skips one TX\npackage while still expecting a response in\nmcp251xfd_handle_tefif_one().\n\nResolve the issue by starting a workqueue to write the tx obj\nsynchronously if err = -EBUSY. In case of another error, decrement\ntx_ring->head, remove skb from the echo stack, and drop the message.\n\n[mkl: use more imperative wording in patch description]"
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c",
                  "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c",
                  "drivers/net/can/spi/mcp251xfd/mcp251xfd.h"
               ],
               "versions": [
                  {
                     "version": "55e5b97f003e",
                     "lessThan": "f926c022ebaa",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "55e5b97f003e",
                     "lessThan": "3e72558c1711",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "55e5b97f003e",
                     "lessThan": "6c6b4afa59c2",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "55e5b97f003e",
                     "lessThan": "d8fb63e46c88",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c",
                  "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c",
                  "drivers/net/can/spi/mcp251xfd/mcp251xfd.h"
               ],
               "versions": [
                  {
                     "version": "5.10",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "5.10",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.97",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6.37",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.9.8",
                     "lessThanOrEqual": "6.9.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.10",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025"
            },
            {
               "url": "https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b"
            },
            {
               "url": "https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729"
            },
            {
               "url": "https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510"
            }
         ],
         "title": "can: mcp251xfd: fix infinite loop when xmit fails",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-41088",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}