CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable()
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: core: delete incorrect free in pinctrlenable()
The "pctldev" struct is allocated in devmpinctrlregisterandinit(). It's a devm managed pointer that is freed by devmpinctrldevrelease(), so freeing it in pinctrlenable() will lead to a double free.
The devmpinctrldevrelease() function frees the pindescs and destroys the mutex as well.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: core: delete incorrect free in pinctrlenable()
The Linux kernel CVE team has assigned CVE-2024-36940 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024053043-CVE-2024-36940-0c83@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.314 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.276 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.217 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.159 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.91 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.31 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.10 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch CVE-2024-36940
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36940?
CVE-2024-36940 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-36940?
To fix CVE-2024-36940, update to a kernel version that is equal to or higher than the remedied versions specified in the vulnerability report.
What are the affected kernel versions for CVE-2024-36940?
CVE-2024-36940 affects several kernel versions, specifically those below 4.19.314, 5.4.276, 5.10.217, 5.15.159, 6.1.91, 6.6.31, and 6.8.10.
Which Linux distributions are impacted by CVE-2024-36940?
CVE-2024-36940 impacts various distributions that utilize vulnerable kernel versions, particularly those based on the Red Hat and Debian kernels.
Is CVE-2024-36940 being actively exploited?
There are currently no reports indicating active exploitation of CVE-2024-36940 in the wild.