CVE-2024-58079 Details
Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled. If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS. We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete. Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error.
A use-after-free vulnerability has been identified in the Linux kernel's UVC video driver, specifically in versions prior to the fix. The issue arises when the driver is unbound from a USB interface while still using GPIO units. This improper handling can lead to a crash, as the interrupt request (IRQ) is not disabled, allowing the system to access already freed memory, which causes a kernel OOPS error. The vulnerability only affects devices with active GPIO units and requires the driver to be manually unbound, as a simple disconnection does not trigger the error.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading the kernel can be found in the documentation for the specific Linux distribution in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.12, < 5.15.179 >= 5.16, < 6.1.130 >= 6.2, < 6.6.78 >= 6.7, < 6.12.14 >= 6.13, < 6.13.3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 3, 2025 | CVE Modified | CVE |
| Oct 31, 2025 | Initial Analysis | [email protected] |
| Mar 13, 2025 | CVE Modified | kernel.org |
| Mar 7, 2025 | CVE Modified | kernel.org |
| Mar 6, 2025 | New CVE Received | kernel.org |