CVE-2024-50267

USB: serial: io_edgeport: fix use after free in debug printk

State: Published
Severity: 7.8 High
Published: Nov 19, 2024
Updated: Aug 5, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_edgeport: fix use after free in debug printk

The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid this issue.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	984f68683298ba53af32f909de1f9452fbb37ccb to before e6ceb04eeb6115d872d4c4078d12f1170ed755ceAffected 984f68683298ba53af32f909de1f9452fbb37ccb to before 39709ce93f5c3f9eb535efe2afea088805d1128fAffected 984f68683298ba53af32f909de1f9452fbb37ccb to before e567fc8f7a4460e486e52c9261b1e8b9f5dc42aaAffected 984f68683298ba53af32f909de1f9452fbb37ccb to before 44fff2c16c5aafbdb70c7183dae0a415ae74705eAffected 984f68683298ba53af32f909de1f9452fbb37ccb to before 275258c30bbda29467216e96fb655b16bcc9992bAffected 984f68683298ba53af32f909de1f9452fbb37ccb to before 13d6ff3ca76056d06a9d88300be2a293442ff595Affected 984f68683298ba53af32f909de1f9452fbb37ccb to before 314bdf446053e123f37543aa535197ee75f8aa97Affected 984f68683298ba53af32f909de1f9452fbb37ccb to before 37bb5628379295c1254c113a407cab03a0f4d0b4Affected
LinuxLinux	3.7Affected before 3.7Not affected 4.19.324 through 4.19.Not affected 5.4.286 through 5.4.Not affected 5.10.230 through 5.10.Not affected 5.15.172 through 5.15.Not affected 6.1.117 through 6.1.Not affected 6.6.61 through 6.6.Not affected 6.11.8 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

984f68683298ba53af32f909de1f9452fbb37ccb to before e6ceb04eeb6115d872d4c4078d12f1170ed755ceAffected
984f68683298ba53af32f909de1f9452fbb37ccb to before 39709ce93f5c3f9eb535efe2afea088805d1128fAffected
984f68683298ba53af32f909de1f9452fbb37ccb to before e567fc8f7a4460e486e52c9261b1e8b9f5dc42aaAffected
984f68683298ba53af32f909de1f9452fbb37ccb to before 44fff2c16c5aafbdb70c7183dae0a415ae74705eAffected
984f68683298ba53af32f909de1f9452fbb37ccb to before 275258c30bbda29467216e96fb655b16bcc9992bAffected
984f68683298ba53af32f909de1f9452fbb37ccb to before 13d6ff3ca76056d06a9d88300be2a293442ff595Affected
984f68683298ba53af32f909de1f9452fbb37ccb to before 314bdf446053e123f37543aa535197ee75f8aa97Affected
984f68683298ba53af32f909de1f9452fbb37ccb to before 37bb5628379295c1254c113a407cab03a0f4d0b4Affected

LinuxLinux

3.7Affected
before 3.7Not affected
4.19.324 through 4.19.*Not affected
5.4.286 through 5.4.*Not affected
5.10.230 through 5.10.*Not affected
5.15.172 through 5.15.*Not affected
6.1.117 through 6.1.*Not affected
6.6.61 through 6.6.*Not affected
6.11.8 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.