Riskcovery

CVE-2024-27392

nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()

State
Published
Severity
7.8 High
Published
May 1, 2024
Updated
Aug 5, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()

When nvme_identify_ns() fails, it frees the pointer to the struct nvme_id_ns before it returns. However, ns_update_nuse() calls kfree() for the pointer even when nvme_identify_ns() fails. This results in KASAN double-free, which was observed with blktests nvme/045 with proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by skipping kfree() when nvme_identify_ns() fails.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a1a825ab6a60380240ca136596732fdb80bad87a to before 534f9dc7fe495b3f9cc84363898ac50c5a25fccbAffected
  • a1a825ab6a60380240ca136596732fdb80bad87a to before 8d0d2447394b13fb22a069f0330f9c49b7fff9d3Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.8.2 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.