Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2024-50071: Linux kernel pin control can cause crashes on removal
CVE-2024-50071 · published 2 years ago
Summary
The Linux kernel code that manages pin settings for Nuvoton MA35 devices could free the same memory twice when the device is removed, which may lead to a crash or instability. This affects any system running the Linux kernel, including Debian and other distributions. Update to the latest kernel version that includes the fix, or apply the provided patch, to prevent the double‑free error.
What to do
- Update debian linux to version 6.11.5-1.
- Update linux kernel to version 6.11.5.
- Update linux linux_kernel to version 6.11.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 6.11, < 6.11.5 6.12 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Debian:13 | debian | linux |
< 6.11.5-1 Fix: upgrade to 6.11.5-1
|
| Linux | linux | kernel |
>= 6.11.0, < 6.11.5 Fix: upgrade to 6.11.5
|
Original advisory text
pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() 'new_map' is allocated using devm_* which takes care of freeing the allocated data on device removal, call to .dt_free_map = pinconf_generic_dt_free_map double frees the map as pinconf_generic_dt_free_map() calls pinctrl_utils_free_map(). Fix this by using kcalloc() instead of auto-managed devm_kcalloc().
References
- https://git.kernel.org/stable/c/3fd976afe9743110f20a23f93b7ff9693f2be4bf URL
- https://git.kernel.org/stable/c/6441d9c3d71b59c8fd27d4e381c7471a32ac1a68 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50071... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-50071 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://security-tracker.debian.org/tracker/CVE-2024-50071 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-415Double Free
Timeline
Published29 Oct 2024
Updated2 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta