In the Linux kernel, the following vulnerability has been resolved:
dmaengine: apple-admac: Fix 'current_tx' not getting freed
In terminate_all we should queue up all submitted descriptors to be
freed. We do that for the content of the 'issued' and 'submitted' lists,
but the 'current_tx' descriptor falls through the cracks as it's
removed from the 'issued' list once it gets assigned to be the current
descriptor. Explicitly queue up freeing of the 'current_tx' descriptor
to address a memory leak that is otherwise present.
References 3
https://git.kernel.org/stable/c/b7abd535881a48587961c2099b1d2933ebd42c4b
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d9503be5a100c553731c0e8a82c7b4201e8a970c
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fd4d88e68c75caf5c6f8293a36bc3ae289e0369e
416baaa9-dc9f-4396-8d5f-8c081fb06d67