PT-2024-7601 · Linux+6 · Linux Kernel+6
Aleksandr Burakov
·
Published
2024-10-06
·
Updated
2025-09-29
·
CVE-2024-49986
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.58
Description
The issue is related to the reuse of previously freed memory in the
x86 android tablet probe() function within the Linux kernel. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when platform device register() fails, and the pdevs[] array is used after being freed by x86 android tablet remove(). To avoid this, the PTR ERR() value should be stored before calling x86 android tablet remove().Recommendations
For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider modifying the code to store the
PTR ERR() value before calling x86 android tablet remove() to avoid using the pdevs[] array after it has been freed. Restrict access to the vulnerable x86 android tablet probe() function until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu