CVE-2024-36973 — Double Free in Linux
Severity
7.8HIGHNVD
OSV5.5
EPSS
0.0%
top 92.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 17
Latest updateSep 23
Description
In the Linux kernel, the following vulnerability has been resolved:
misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function
gp_auxiliary_device_release() calls ida_free() and
kfree(aux_device_wrapper) to free memory. We should't
call them again in the error handling path.
Fix this by skipping the redundant cleanup functions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages6 packages
▶CVEListV5linux/linux393fc2f5948fd340d016a9557eea6e1ac2f6c60c — 34ae447b138680b5ed3660f7d935ff3faf88ba1a+4