CVE-2024-36973

misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()

State: Published
Severity: 8.4 High
Published: Jun 17, 2024
Updated: Aug 5, 2026
Reserved: May 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()

When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function gp_auxiliary_device_release() calls ida_free() and kfree(aux_device_wrapper) to free memory. We should't call them again in the error handling path.

Fix this by skipping the redundant cleanup functions.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	393fc2f5948fd340d016a9557eea6e1ac2f6c60c to before 34ae447b138680b5ed3660f7d935ff3faf88ba1aAffected 393fc2f5948fd340d016a9557eea6e1ac2f6c60c to before 86c9713602f786f441630c4ee02891987f8618b9Affected 393fc2f5948fd340d016a9557eea6e1ac2f6c60c to before 1efe551982297924d05a367aa2b6ec3d275d5742Affected 393fc2f5948fd340d016a9557eea6e1ac2f6c60c to before 086c6cbcc563c81d55257f9b27e14faf1d0963d3Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.95 through 6.1.Not affected 6.6.35 through 6.6.Not affected 6.9.6 through 6.9.*Not affected 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.