Linux Kernel Driver Core NULL Pointer Dereference Vulnerability in dev_uevent()

A vulnerability in the Linux kernel's driver core can lead to a NULL pointer dereference in the dev_uevent() function. This issue arises when userspace simultaneously accesses the 'uevent' device attribute while another thread unbinds the device from its driver. The transition of the dev->driver pointer from a valid reference to NULL can cause a crash. The vulnerability has been addressed by using READ_ONCE() to safely retrieve the driver pointer and by locking the bus' drivers klist to prevent the driver instance from being removed during access. Additionally, WRITE_ONCE() is used when updating the driver pointer to avoid data tearing.

Impact

Exploitation of this vulnerability can cause a system crash due to a NULL pointer dereference.