Linux Kernel Slimbus Messaging Transaction ID Memory Management Vulnerability

A vulnerability in the Linux kernel's Slimbus messaging component can lead to invalid memory access. This issue arises because, in certain delayed interrupt scenarios, the function 'slim_do_transfer()' fails to properly free the transaction ID (TID) before returning a timeout error. The failure to release the TID can cause a kernel panic by triggering a fatal exception during an interrupt, as evidenced by a call trace that includes 'qcom_slim_ngd_rx_msgq_cb()', which is part of the 'slim_qcom_ngd_ctrl' module.

Impact

Exploitation of this vulnerability causes a kernel panic, leading to a system crash.