Linux Kernel Tegra20 Slink UAF Vulnerability in SPI Controller

A use-after-free vulnerability has been identified in the Linux kernel's SPI subsystem, specifically within the Tegra20 SLINK implementation. The issue arises in the 'tegra_slink_remove()' function, where the SPI master is unregistered. This process decreases the reference count of the master to zero, leading to its deallocation. Consequently, when 'tspi' is used, it results in a use-after-free condition. The vulnerability has been addressed by modifying the sequence of operations: the master is now retrieved before unregistration and released after use.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.