In the Linux kernel, the following vulnerability has been resolved:
ppp: fix race conditions in ppp_fill_forward_path
ppp_fill_forward_path() has two race conditions:
- The ppp->channels list can change between list_empty() and
- pch->chan can be NULL. When ppp_unregister_channel() is called,
Fix these by using a lockless RCU approach:
- Use list_first_or_null_rcu() to safely test and access the first list
- Convert list modifications on ppp->channels to their RCU variants and
- Check for a NULL pch->chan before dereferencing it.