CVE-2024-58055

usb: gadget: f_tcm: Don't free command immediately

State: Published
Severity: 7.8 High
Published: Mar 6, 2025
Updated: May 11, 2026
Reserved: Mar 6, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: Don't free command immediately

Don't prematurely free the command. Wait for the status completion of the sense status. It can be freed then. Otherwise we will double-free the command.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 7cb72dc08ed8da60fd6d1f6adf13bf0e6ee0f694Affected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 38229c35a6d7875697dfb293356407330cfcd23eAffected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before bbb7f49839b57d66ccaf7b5752d9b63d3031dd0aAffected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before f0c33e7d387ccbb6870e73a43c558fefede06614Affected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 16907219ad6763f401700e1b57b2da4f3e07f047Affected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 929b69810eec132b284ffd19047a85d961df9e4dAffected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before e6693595bd1b55af62d057a4136a89d5c2ddf0e9Affected cff834c16d23d614388aab1b86d19eb67b3f80c4 to before c225d006a31949d673e646d585d9569bc28feeb9Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.129 through 6.1.Not affected 6.6.76 through 6.6.Not affected 6.12.13 through 6.12.Not affected 6.13.2 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 7cb72dc08ed8da60fd6d1f6adf13bf0e6ee0f694Affected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 38229c35a6d7875697dfb293356407330cfcd23eAffected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before bbb7f49839b57d66ccaf7b5752d9b63d3031dd0aAffected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before f0c33e7d387ccbb6870e73a43c558fefede06614Affected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 16907219ad6763f401700e1b57b2da4f3e07f047Affected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before 929b69810eec132b284ffd19047a85d961df9e4dAffected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before e6693595bd1b55af62d057a4136a89d5c2ddf0e9Affected
cff834c16d23d614388aab1b86d19eb67b3f80c4 to before c225d006a31949d673e646d585d9569bc28feeb9Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.129 through 6.1.*Not affected
6.6.76 through 6.6.*Not affected
6.12.13 through 6.12.*Not affected
6.13.2 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.