Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2024-27433: Linux kernel may crash when Mediatek MT7622 clock removed
CVE-2024-27433 · published 2 years ago
Summary
The Linux kernel’s Mediatek MT7622 clock driver could try to free the same memory twice during shutdown, which can cause a system crash or instability. The problem has been corrected by removing the redundant free operation. Apply the latest kernel updates that include this fix to keep systems stable.
What to do
- Update debian linux to version 6.7.12-1.
- Update linux kernel to version 6.8.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | linux |
< 6.7.12-1 Fix: upgrade to 6.7.12-1
|
| Debian:14 | debian | linux |
< 6.7.12-1 Fix: upgrade to 6.7.12-1
|
| – | linux | linux_kernel |
>= 6.4, < 6.6.23 >= 6.7, < 6.7.11 >= 6.8, < 6.8.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Linux | linux | kernel |
>= 6.8.0, < 6.8.2 Fix: upgrade to 6.8.2
|
Original advisory text
clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe()
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() 'clk_data' is allocated with mtk_devm_alloc_clk_data(). So calling mtk_free_clk_data() explicitly in the remove function would lead to a double-free. Remove the redundant call.
References
- https://security-tracker.debian.org/tracker/CVE-2024-27433 Vendor Advisory
- https://git.kernel.org/stable/c/a32e88f2b20259f5fe4f8eed598bbc85dc4879ed URL
- https://git.kernel.org/stable/c/de3340533bd68a7b3d6be1841b8eb3fa6c762fe6 URL
- https://git.kernel.org/stable/c/f3633fed984f1db106ff737a0bb52fadb2d89ac7 URL
- https://git.kernel.org/stable/c/fa761ce7a1d15cca1a306b3635f81a22b15fee5b URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27433... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-27433 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-415Double Free
Timeline
Published17 May 2024
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta