{"id":"CVE-2024-26875","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/p…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/p…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.26, < 4.19.311","linux_kernel >= 4.20, < 5.4.273","linux_kernel >= 5.5, < 5.10.214","linux_kernel >= 5.11, < 5.15.153","linux_kernel >= 5.16, < 6.1.83","linux_kernel >= 6.2, < 6.6.23","linux_kernel >= 6.7, < 6.7.11","linux_kernel >= 6.8, < 6.8.2"],"patched":["linux_kernel 6.8.2"],"published":"2024-04-17","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:17:27.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-26875","references":[{"url":"https://git.kernel.org/stable/c/0a0b79ea55de8514e1750884e5fec77f9fdd01ee","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a1ec89708d2e57e2712f46241282961b1a7a475","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40cd818fae875c424a8335009db33c7b5a07de3a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e60b99f6b7ccb3badeb512f5eb613ad45904592","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab896d93fd6a2cd1afeb034c3cc9226cb499209f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d29ed08964cec8b9729bc55c7bb23f679d7a18fb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaa410e05bdf562c90b23cdf2d9327f9c4625e16","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb6e9dce979c08210ff7249e5e0eceb8991bfcd7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed8000e1e8e9684ab6c30cf2b526c0cea039929c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a0b79ea55de8514e1750884e5fec77f9fdd01ee","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/3a1ec89708d2e57e2712f46241282961b1a7a475","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/40cd818fae875c424a8335009db33c7b5a07de3a","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/8e60b99f6b7ccb3badeb512f5eb613ad45904592","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ab896d93fd6a2cd1afeb034c3cc9226cb499209f","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/d29ed08964cec8b9729bc55c7bb23f679d7a18fb","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/eaa410e05bdf562c90b23cdf2d9327f9c4625e16","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/eb6e9dce979c08210ff7249e5e0eceb8991bfcd7","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ed8000e1e8e9684ab6c30cf2b526c0cea039929c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00247,"epssPercentile":0.15871,"ingestedAt":"2026-10-15T03:30:12.654Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-08-08T18:16:38.134267Z"},"slug":"CVE-2024-26875","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\nRead of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26\n\nCPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc4/0x620 mm/kasan/report.c:488\n kasan_report+0xda/0x110 mm/kasan/report.c:601\n pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\n pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]\n pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272\n\nFreed by task 906:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:47\nkasan_save_track+0x14/0x30 mm/kasan/common.c:68\nkasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\npoison_slab_object mm/kasan/common.c:241 [inline]\n__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257\nkasan_slab_free include/linux/kasan.h:184 [inline]\nslab_free_hook mm/slub.c:2121 [inline]\nslab_free mm/slub.c:4299 [inline]\nkfree+0x105/0x340 mm/slub.c:4409\npvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]\npvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158\n\n[Analyze]\nTask A set disconnect_flag = !0, which resulted in Task B's condition being met\nand releasing mp, leading to this issue.\n\n[Fix]\nPlace the disconnect_flag assignment operation after all code in pvr2_context_disconnect()\nto avoid this issue.\n\n## Affected\n\n- `linux_kernel >= 2.6.26, < 4.19.311`\n- `linux_kernel >= 4.20, < 5.4.273`\n- `linux_kernel >= 5.5, < 5.10.214`\n- `linux_kernel >= 5.11, < 5.15.153`\n- `linux_kernel >= 5.16, < 6.1.83`\n- `linux_kernel >= 6.2, < 6.6.23`\n- `linux_kernel >= 6.7, < 6.7.11`\n- `linux_kernel >= 6.8, < 6.8.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.8.2`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}