Linux Kernel Duplicate Device Registration Vulnerability in PCI Express Subsystem

A vulnerability in the Linux kernel's PCI Express subsystem has been addressed, which involved improper handling of PCI device data during the registration of platform devices. The issue arose because the PCI device structure was incorrectly used as platform data, leading to a duplicated copy of the PCI device. This duplication caused corruption in the device list, as the mutex information, including the device's list and magic values, remained identical to the original device, creating potential for list corruption.

Impact

The vulnerability could lead to memory corruption by allowing duplicated device entries to interfere with the device management lists, potentially causing instability or unexpected behavior in the system.