1. Home
  2. CVE Database
  3. CVE-2024-26652
MEDIUM · 4.1

CVE-2024-26652

In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_...

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev) to free memory. We shouldn't call kfree(padev) again in the error handling path. Fix this by cleaning up the redundant kfree() and putting the error handling back to where the errors happened.

CVSS Score

4.1

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
LinuxLinux Kernel>= 6.4, < 6.6.22

Related Weaknesses (CWE)

CWE-415

References

FAQ

What is CVE-2024-26652?

CVE-2024-26652 is a vulnerability with a CVSS score of 4.1 (MEDIUM). In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_...

How severe is CVE-2024-26652?

CVE-2024-26652 has been rated MEDIUM with a CVSS base score of 4.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-26652?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.