CVE-2024-58079 media: uvcvideo: Fix crash during unbind if gpio unit is in use

High 7.8 Published 6 Mar 2025 Updated 15 Oct 2026

A use-after-free vulnerability in the Linux kernel uvcvideo driver allows a local attacker to cause a system crash by unbinding a USB device with a GPIO unit.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-58079?

CVE-2024-58079 is a high-severity use after free vulnerability in Linux kernel, published on 6 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix crash during unbind if gpio unit is in use

We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device.

If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled.

If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS.

We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete.

Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error.

Which versions are affected by CVE-2024-58079?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2024-58079?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-58079 being exploited?

There is no known exploitation of CVE-2024-58079 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2024-58079, DEBIAN-CVE-2024-58079, GHSA-fgjx-56hm-4qrp, ROOT-OS-UBUNTU-2404-CVE-2024-58079, UBUNTU-CVE-2024-58079.