CVE-2024-27039

MEDIUM

Linux Kernel 5.14-5.15.152, 5.16-6.1.82, 6.2-6.6.22, 6.7-6.7.10, 6.8-6.8.1 - Use-After-Free in Clock Driver

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration. If a clk_register() call fails, 'p_clk' may point to something different from what should be freed. The best we can do, is to avoid this wrong release of memory.

Scores

CVSS v3 5.5
EPSS 0.0027
EPSS Percentile 18.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (20)
linux/Kernel 5.14.0 - 5.15.153linux
linux/Kernel 5.16.0 - 6.1.83linux
linux/Kernel 6.2.0 - 6.6.23linux
linux/Kernel 6.7.0 - 6.7.11linux
linux/Kernel 6.8.0 - 6.8.2linux
Linux/Linux < 5.14
Linux/Linux 5.14
Linux/Linux 5.15.153 - 5.15.*
Linux/Linux 6.1.83 - 6.1.*
Linux/Linux 6.6.23 - 6.6.*
... and 10 more
Published May 01, 2024
Tracked Since Feb 18, 2026