CVE-2024-50055

driver core: bus: Fix double free in driver API bus_register()

HIGH

7.8

CVSS Score

Published: October 21, 2024 at 07:39 PM UTC

Updated: August 5, 2026 at 12:05 PM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

v < 5.4.2915.11 ≤ v < 5.15.1745.16 ≤ v < 6.1.1205.5 ≤ v < 5.10.2316.2 ≤ v < 6.6.576.3 ≤ v < 6.11.46.3 ≤ v < 6.126.3 ≤ v < 6.6.576.7 ≤ v < 6.11.43465e2e4a24eef9bc9f21aa29d83fd7000c1da486.3

Vendor states this is fixed in 9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a (fixed)

Vendor states this is fixed in bfa54a793ba77ef696755b66f3ac4ed00c7d1248 (fixed)

Vendor states this is fixed in d885c464c25018b81a6b58f5d548fc2e3ef87dd1 (fixed)

Affected range stops below 5.10.231, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.15.174, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.4.291, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.120, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.11.4 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)

Vendor states this is fixed in 6.3 (unaffected)

Vendor states this is fixed in 6.6.57 (unaffected)