CVE-2024-38554

ax25: Fix reference count leak issue of net_device

State: Published
Severity: Not scored
Published: Jun 19, 2024
Updated: May 23, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ax25: Fix reference count leak issue of net_device

There is a reference count leak issue of the object "net_device" in ax25_dev_device_down(). When the ax25 device is shutting down, the ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak.

In order to solve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 3ec437f9bbae68e9b38115c4c91de995f73f6badAffected d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 965d940fb7414b310a22666503d2af69459c981bAffected d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 8bad3a20a27be8d935f2aae08d3c6e743754944aAffected d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before eef95df9b752699bddecefa851f64858247246e9Affected d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 36e56b1b002bb26440403053f19f9e1a8bc075b2Affected ef0a2a0565727a48f2e36a2c461f8b1e3a61922dAffected e2b558fe507a1ed4c43db2b0057fc6e41f20a14cAffected 418993bbaafb0cd48f904ba68eeda052d624c821Affected 5ea00fc60676c0eebfa8560ec461209d638bca9dAffected 9af0fd5c4453a44c692be0cbb3724859b75d739bAffected 4.14.277 to before 4.15Affected 4.19.240 to before 4.20Affected 5.4.190 to before 5.5Affected 5.10.112 to before 5.11Affected 5.15.35 to before 5.16Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.8.12 through 6.8.Not affected 6.9.3 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 3ec437f9bbae68e9b38115c4c91de995f73f6badAffected
d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 965d940fb7414b310a22666503d2af69459c981bAffected
d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 8bad3a20a27be8d935f2aae08d3c6e743754944aAffected
d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before eef95df9b752699bddecefa851f64858247246e9Affected
d01ffb9eee4af165d83b08dd73ebdf9fe94a519b to before 36e56b1b002bb26440403053f19f9e1a8bc075b2Affected
ef0a2a0565727a48f2e36a2c461f8b1e3a61922dAffected
e2b558fe507a1ed4c43db2b0057fc6e41f20a14cAffected
418993bbaafb0cd48f904ba68eeda052d624c821Affected
5ea00fc60676c0eebfa8560ec461209d638bca9dAffected
9af0fd5c4453a44c692be0cbb3724859b75d739bAffected
4.14.277 to before 4.15Affected
4.19.240 to before 4.20Affected
5.4.190 to before 5.5Affected
5.10.112 to before 5.11Affected
5.15.35 to before 5.16Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.93 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.8.12 through 6.8.*Not affected
6.9.3 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.