CVE-2024-57980
High
Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Reviewed by: Ricardo Ribalda <[email protected]>
SeverityHigh
CVSS7.8
Exploit probability—
Product
Linux Kernel
PublishedFeb 27, 2025
First seenFeb 27, 2025
Weakness typeCWE-415CWE-415
How to fix
Update
- linux linux_kernel6.1.129, 6.6.76, 6.12.13, 6.13.2 or later
Patches
- git.kernel.org/stable/c/6c36dcd662ec5276782838660f8533a7cb26be49
- git.kernel.org/stable/c/9232719ac9ce4d5c213cebda23d72aec3e1c4c0d
- git.kernel.org/stable/c/c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac
- git.kernel.org/stable/c/d1f8e69eec91d5a75ef079778a5d0151db2a7f22
- git.kernel.org/stable/c/d8e63dd7b6683969d3d47c7b8e9635f96d554ad4
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.28 ≤ v < 6.1.129, 6.2 ≤ v < 6.6.76, 6.7 ≤ v < 6.12.13, 6.13 ≤ v < 6.13.2 | 6.1.129, 6.6.76, 6.12.13, 6.13.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.