---
id: CVE-2024-38630
title: 'watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger

  When the cpu5wdt module is removing, the origin code uses del_timer() to
  de-activate the timer. I…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    948ed659c0151a605bd126da1e95f350ec5a7956
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    9abe50e8492d1accd7d8dc17991179472d3d4573
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    9b1c063ffc075abf56f63e55d70b9778ff534314
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f19686d616500cd0d47b30cee82392b53f7f784a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    573601521277119f2e2ba5f28ae6e87fc594f4d4
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T17:09:05.880196Z'
published: '2024-06-21'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:18:35.686Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-38630'
references:
  - url: 'https://git.kernel.org/stable/c/948ed659c0151a605bd126da1e95f350ec5a7956'
  - url: 'https://git.kernel.org/stable/c/9abe50e8492d1accd7d8dc17991179472d3d4573'
  - url: 'https://git.kernel.org/stable/c/9b1c063ffc075abf56f63e55d70b9778ff534314'
  - url: 'https://git.kernel.org/stable/c/f19686d616500cd0d47b30cee82392b53f7f784a'
  - url: 'https://git.kernel.org/stable/c/573601521277119f2e2ba5f28ae6e87fc594f4d4'
tags:
  - cve.org
epss: 0.00251
epssPercentile: 0.16564
ingestedAt: '2026-11-03T12:44:28.821Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger

When the cpu5wdt module is removing, the origin code uses del_timer() to
de-activate the timer. If the timer handler is running, del_timer() could
not stop it and will return directly. If the port region is released by
release_region() and then the timer handler cpu5wdt_trigger() calls outb()
to write into the region that is released, the use-after-free bug will
happen.

Change del_timer() to timer_shutdown_sync() in order that the timer handler
could be finished before the port region is released.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 948ed659c0151a605bd126da1e95f350ec5a7956`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9abe50e8492d1accd7d8dc17991179472d3d4573`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9b1c063ffc075abf56f63e55d70b9778ff534314`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f19686d616500cd0d47b30cee82392b53f7f784a`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 573601521277119f2e2ba5f28ae6e87fc594f4d4`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.