CVE-2024-36959: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: devicetree: fix refcount leak in pinctrldttomap()
If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrldtfreemaps() includes the droping operation, here we call it directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.11-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36959?
The severity of CVE-2024-36959 is categorized as high due to potential impact on device functionality.
How do I fix CVE-2024-36959?
To fix CVE-2024-36959, upgrade to a patched version of the Linux Kernel, such as 5.10.223-1 or later.
Which Linux Kernel versions are affected by CVE-2024-36959?
CVE-2024-36959 affects Linux Kernel versions between 4.9.334 and 6.9-rc6, including specific ranges.
What type of vulnerability is CVE-2024-36959?
CVE-2024-36959 is a reference count leak vulnerability found in the pinctrl component of the Linux kernel.
Is there an exploit available for CVE-2024-36959?
As of now, there is no public exploit reported for CVE-2024-36959, but the vulnerability should still be addressed promptly.