CVE-2024-57904

HIGH

Linux Kernel Use-After-Free in ADC Driver Input Device Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input.

References (9)

Core 9

Scores

CVSS v3 7.8
EPSS 0.0023
EPSS Percentile 13.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (24)
linux/Kernel 3.16.0 - 5.4.290linux
linux/Kernel 5.11.0 - 5.15.177linux
linux/Kernel 5.16.0 - 6.1.125linux
linux/Kernel 5.5.0 - 5.10.234linux
linux/Kernel 6.2.0 - 6.6.72linux
linux/Kernel 6.7.0 - 6.12.10linux
Linux/Linux < 3.16
Linux/Linux 3.16
Linux/Linux 5.10.234 - 5.10.*
Linux/Linux 5.15.177 - 5.15.*
... and 14 more
Published Jan 19, 2025
Tracked Since Feb 18, 2026