CVE-2024-46741

misc: fastrpc: Fix double free of 'buf' in error path

State: Published
Severity: 7.8 High
Published: Sep 18, 2024
Updated: Aug 27, 2026
Reserved: Sep 11, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix double free of 'buf' in error path

smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf'

In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful.

But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	13327ed95222e70fa98805382b65636b872d87cb to before 4753cc37b6606ef9a7ec22861d380d45e2707f9aAffected 72fa6f7820c4cf96c5f7aabc4e54bdf52d1e2ac2 to before f77dc8a75859e559f3238a6d906206259227985eAffected 72fa6f7820c4cf96c5f7aabc4e54bdf52d1e2ac2 to before bfc1704d909dc9911a558b1a5833d3d61a43a1f2Affected 72fa6f7820c4cf96c5f7aabc4e54bdf52d1e2ac2 to before e8c276d4dc0e19ee48385f74426aebc855b49aafAffected 911737ad0c860251f640a05feb75f9dc7e41f0d7Affected b10e064ca0f708c4b4401ac5eab0f76cf7cec93dAffected 5.10.267 to before 5.11Affected 5.15.218 to before 5.16Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.51 through 6.6.Not affected 6.10.10 through 6.10.Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

13327ed95222e70fa98805382b65636b872d87cb to before 4753cc37b6606ef9a7ec22861d380d45e2707f9aAffected
72fa6f7820c4cf96c5f7aabc4e54bdf52d1e2ac2 to before f77dc8a75859e559f3238a6d906206259227985eAffected
72fa6f7820c4cf96c5f7aabc4e54bdf52d1e2ac2 to before bfc1704d909dc9911a558b1a5833d3d61a43a1f2Affected
72fa6f7820c4cf96c5f7aabc4e54bdf52d1e2ac2 to before e8c276d4dc0e19ee48385f74426aebc855b49aafAffected
911737ad0c860251f640a05feb75f9dc7e41f0d7Affected
b10e064ca0f708c4b4401ac5eab0f76cf7cec93dAffected
5.10.267 to before 5.11Affected
5.15.218 to before 5.16Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.51 through 6.6.*Not affected
6.10.10 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.