CVE-2024-58078 misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
A mismatch in ID allocation and freeing in the Linux kernel misc device subsystem can trigger a warning and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58078?
CVE-2024-58078 is a medium-severity vulnerability in Linux kernel, published on 6 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
misc_minor_alloc was allocating id using ida for minor only in case of MISC_DYNAMIC_MINOR but misc_minor_free was always freeing ids using ida_free causing a mismatch and following warn: > > WARNING: CPU: 0 PID: 159 at lib/idr.c:525 ida_free+0x3e0/0x41f > > ida_free called for id=127 which is not allocated. > > <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< ... > > [<60941eb4>] ida_free+0x3e0/0x41f > > [<605ac993>] misc_minor_free+0x3e/0xbc > > [<605acb82>] misc_deregister+0x171/0x1b3
misc_minor_alloc is changed to allocate id from ida for all minors falling in the range of dynamic/ misc dynamic minors
Which versions are affected by CVE-2024-58078?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-58078?
Apply the vendor's patch.
Is CVE-2024-58078 being exploited?
There is no known exploitation of CVE-2024-58078 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-58078, DEBIAN-CVE-2024-58078, GHSA-q3gj-8hcr-xvrx, ROOT-OS-UBUNTU-2404-CVE-2024-58078, UBUNTU-CVE-2024-58078.