CVE-2024-38627

stm class: Fix a double free in stm_register_device()

HIGH

7.8

CVSS Score

Published: June 21, 2024 at 10:18 AM UTC

Updated: June 17, 2026 at 07:40 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v ≥ 4.4.1784.20 ≤ v < 5.4.2784.4.178 ≤ v < 4.54.7 ≤ v < 4.19.3164.7 ≤ v < 5.10.2194.7 ≤ v < 5.15.1614.7 ≤ v < 5.4.2784.7 ≤ v < 6.1.934.7 ≤ v < 6.104.7 ≤ v < 6.6.334.7 ≤ v < 6.9.45.11 ≤ v < 5.15.1615.16 ≤ v < 6.1.935.5 ≤ v < 5.10.2196.2 ≤ v < 6.6.336.7 ≤ v < 6.9.4389b6699a2aa0b457aa69986e9ddf39f3b4030fd4.4.178 4.7b0351a51ffda593b2b1b35dd0c00a73505edb256

Vendor states this is fixed in 370c480410f60b90ba3e96abe73ead21ec827b20 (fixed)

Vendor states this is fixed in 3df463865ba42b8f88a590326f4c9ea17a1ce459 (fixed)

Vendor states this is fixed in 4bfd48bb6e62512b9c392c5002c11e1e3b18d247 (fixed)

Vendor states this is fixed in 6cc30ef8eb6d8f8d6df43152264bbf8835d99931 (fixed)

Vendor states this is fixed in 713fc00c571dde4af3db2dbd5d1b0eadc327817b (fixed)

Vendor states this is fixed in 7419df1acffbcc90037f6b5a2823e81389659b36 (fixed)

Vendor states this is fixed in a0450d3f38e7c6c0a7c0afd4182976ee15573695 (fixed)

Vendor states this is fixed in d782a2db8f7ac49c33b9ca3e835500a28667d1be (fixed)

Vendor states this is fixed in 4.19.316 (unaffected)

Affected range stops below 4.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 4.7 (unaffected)

Vendor states this is fixed in 5.10.219 (unaffected)

Vendor states this is fixed in 5.15.161 (unaffected)

Vendor states this is fixed in 5.4.278 (unaffected)

Vendor states this is fixed in 6.1.93 (unaffected)

Vendor states this is fixed in 6.10 (unaffected)

Vendor states this is fixed in 6.6.33 (unaffected)

Vendor states this is fixed in 6.9.4 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references