Log in Start free

Vulnerability · Published Mar 27, 2024 · Assigned by Linux

CVE-2024-26652net: pds_core: Fix possible double free in error handling path

Medium 4.1

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.3%top 77.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev) to free memory. We shouldn't call kfree(padev) again in the error handling path. Fix this by cleaning up the redundant kfree() and putting the error handling back to where the errors happened.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.7.12-1DEBIAN-CVE-2024-26652
Debian:14linux6.7.12-1DEBIAN-CVE-2024-26652
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-26652
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-26652

Affected products (as reported)

VendorProductVersions
Linux Linux 4569cce43bc61e4cdd76597a1cf9b608846c18cc – before 995f802abff209514ac2ee03b96224237646cec34569cce43bc61e4cdd76597a1cf9b608846c18cc – before ffda0e962f270b3ec937660afd15b685263232d34569cce43bc61e4cdd76597a1cf9b608846c18cc – before ba18deddd6d502da71fd6b6143c53042271b82bd
Linux Linux 6.4

References