CVE-2024-53213

net: usb: lan78xx: Fix double free issue with interrupt buffer allocation

State: Published
Severity: 7.8 High
Published: Dec 27, 2024
Updated: Jun 1, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: lan78xx: Fix double free issue with interrupt buffer allocation

In lan78xx_probe(), the buffer `buf` was being freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` with the `URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused a double free issue.

To resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to simplify the initialization sequence and removed the redundant `kfree(buf)`. Now, `buf` is allocated after `usb_alloc_urb()`, ensuring it is correctly managed by `usb_fill_int_urb()` and freed by `usb_free_urb()` as intended.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	3281ebb3dc5ef19507e65523e9f8c00e20b285ca to before cc5aa8e3ad69dcedeba79e667d4a2efb72a305afAffected dcafa5a8452738eb28085f559b0683d55e22b2f5 to before 2970ef2fce90c661952ec2b451b0276d5f8d6180Affected a6df95cae40bee555e01a37b4023ce8e97ffa249 to before 977128343fc2a30737399b58df8ea77e94f164bdAffected a6df95cae40bee555e01a37b4023ce8e97ffa249 to before a422ebec863d99d5607fb41bb7af3347fcb436d3Affected a6df95cae40bee555e01a37b4023ce8e97ffa249 to before b09512aea6223eec756f52aa584fc29eeab57480Affected a6df95cae40bee555e01a37b4023ce8e97ffa249 to before 7ac9f3c981eeceee2ec4d30d850f4a6f50a1ec40Affected a6df95cae40bee555e01a37b4023ce8e97ffa249 to before 03819abbeb11117dcbba40bfe322b88c0c88a6b6Affected 5.10.252 to before 5.10.258Affected 5.15.202 to before 5.15.209Affected
LinuxLinux	5.17Affected before 5.17Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

3281ebb3dc5ef19507e65523e9f8c00e20b285ca to before cc5aa8e3ad69dcedeba79e667d4a2efb72a305afAffected
dcafa5a8452738eb28085f559b0683d55e22b2f5 to before 2970ef2fce90c661952ec2b451b0276d5f8d6180Affected
a6df95cae40bee555e01a37b4023ce8e97ffa249 to before 977128343fc2a30737399b58df8ea77e94f164bdAffected
a6df95cae40bee555e01a37b4023ce8e97ffa249 to before a422ebec863d99d5607fb41bb7af3347fcb436d3Affected
a6df95cae40bee555e01a37b4023ce8e97ffa249 to before b09512aea6223eec756f52aa584fc29eeab57480Affected
a6df95cae40bee555e01a37b4023ce8e97ffa249 to before 7ac9f3c981eeceee2ec4d30d850f4a6f50a1ec40Affected
a6df95cae40bee555e01a37b4023ce8e97ffa249 to before 03819abbeb11117dcbba40bfe322b88c0c88a6b6Affected
5.10.252 to before 5.10.258Affected
5.15.202 to before 5.15.209Affected

LinuxLinux

5.17Affected
before 5.17Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.