CVE-2024-26652

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26652
In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev) to free memory. We shouldn't call kfree(padev) again in the error handling path. Fix this by cleaning up the redundant kfree() and putting the error handling back to where the errors happened.

4.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/995f802abff209514ac2ee03b96224237646cec3 Patch
https://git.kernel.org/stable/c/ba18deddd6d502da71fd6b6143c53042271b82bd Patch
https://git.kernel.org/stable/c/ffda0e962f270b3ec937660afd15b685263232d3 Patch
https://git.kernel.org/stable/c/995f802abff209514ac2ee03b96224237646cec3 Patch
https://git.kernel.org/stable/c/ba18deddd6d502da71fd6b6143c53042271b82bd Patch
https://git.kernel.org/stable/c/ffda0e962f270b3ec937660afd15b685263232d3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
History

08 Apr 2025, 19:29

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-415
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/995f802abff209514ac2ee03b96224237646cec3 - () https://git.kernel.org/stable/c/995f802abff209514ac2ee03b96224237646cec3 - Patch
References () https://git.kernel.org/stable/c/ba18deddd6d502da71fd6b6143c53042271b82bd - () https://git.kernel.org/stable/c/ba18deddd6d502da71fd6b6143c53042271b82bd - Patch
References () https://git.kernel.org/stable/c/ffda0e962f270b3ec937660afd15b685263232d3 - () https://git.kernel.org/stable/c/ffda0e962f270b3ec937660afd15b685263232d3 - Patch

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/995f802abff209514ac2ee03b96224237646cec3 - () https://git.kernel.org/stable/c/995f802abff209514ac2ee03b96224237646cec3 -
References () https://git.kernel.org/stable/c/ba18deddd6d502da71fd6b6143c53042271b82bd - () https://git.kernel.org/stable/c/ba18deddd6d502da71fd6b6143c53042271b82bd -
References () https://git.kernel.org/stable/c/ffda0e962f270b3ec937660afd15b685263232d3 - () https://git.kernel.org/stable/c/ffda0e962f270b3ec937660afd15b685263232d3 -

04 Nov 2024, 20:35

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: pds_core: corrige posible doble liberación en la ruta de manejo de errores Cuando auxiliar_device_add() devuelve un error y luego llama a auxiliar_device_uninit(), la función de devolución de llamada pdsc_auxbus_dev_release llama a kfree(padev) para liberar memoria. No deberíamos volver a llamar a kfree(padev) en la ruta de manejo de errores. Solucione este problema limpiando el kfree() redundante y devolviendo el manejo de errores al lugar donde ocurrieron los errores.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.1

27 Mar 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-27 14:15

Updated : 2025-04-08 19:29

NVD link : CVE-2024-26652

Mitre link : CVE-2024-26652

CVE.ORG link : CVE-2024-26652

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free