CVE-2024-58003 Details
Description
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as part of their remove process, and if the driver is removed multiple times, eventually leads to put "overflow", possibly causing memory corruption or crash. The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching"), which changed the code related to the sd.fwnode, but missed removing these fwnode_handle_put() calls.
A vulnerability in the Linux kernel's media I2C DS90UB9X3 drivers can lead to memory corruption or crashes. The issue arises because the ub913 and ub953 drivers improperly manage fwnode handles during their removal process. When these drivers are removed multiple times, it can cause a 'put overflow', potentially leading to memory-related issues. This vulnerability was introduced by a previous commit that altered how sub-device fwnodes were handled but failed to address the corresponding cleanup, leaving behind excessive fwnode_handle_put() calls.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/474d7baf91d37bc411fa60de5bbf03c9dd82e18a | kernel.org | Patch |
| https://git.kernel.org/stable/c/60b45ece41c5632a3a3274115a401cb244180646 | kernel.org | Patch |
| https://git.kernel.org/stable/c/70743d6a8b256225675711e7983825f1be86062d | kernel.org | Patch |
| https://git.kernel.org/stable/c/f4e4373322f8d4c19721831f7fb989e52d30dab0 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6, < 6.6.78 >= 6.7, < 6.12.14 >= 6.13, < 6.13.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Oct 23, 2025 | Initial Analysis | [email protected] |
| Feb 27, 2025 | New CVE Received | kernel.org |