CVE-2024-26652 net: pds_core: Fix possible double free in error handling path
A double free vulnerability in the Linux kernel pds_core driver allows attackers to cause a denial of service or potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-26652?
CVE-2024-26652 is a medium-severity use after free vulnerability in Linux kernel, published on 27 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: pds_core: Fix possible double free in error handling path
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev) to free memory. We shouldn't call kfree(padev) again in the error handling path.
Fix this by cleaning up the redundant kfree() and putting the error handling back to where the errors happened.
Weakness: CWE-415
Which versions are affected by CVE-2024-26652?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26652?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-26652 being exploited?
There is no known exploitation of CVE-2024-26652 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26652, DEBIAN-CVE-2024-26652, GHSA-q6fw-pgc6-r84c, UBUNTU-CVE-2024-26652.