[{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"cd099cde4ed2","status":"affected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"6.8","status":"affected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"0","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"6.8.3","status":"unaffected"}]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","cpes":["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"],"versions":[{"version":"6.9","status":"unaffected"}]}]

{"timestamp":"2025-02-05T21:12:31.346092Z","id":"CVE-2024-26932","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/typec/tcpm/tcpm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd099cde4ed264403b434d8344994f97ac2a4349","lessThan":"242e425ed580b2f4dbcb86c8fc03a410a4084a69","versionType":"git","status":"affected"},{"version":"cd099cde4ed264403b434d8344994f97ac2a4349","lessThan":"b63f90487bdf93a4223ce7853d14717e9d452856","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/typec/tcpm/tcpm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.8.3","lessThanOrEqual":"6.8.*","versionType":"semver","status":"unaffected"},{"version":"6.9","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69

https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856

CISA-ADP AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA-ADP CWE-415

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-415

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 6.8 up to (excluding) 6.8.3
     *cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*

https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69 No Types Assigned

https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69 Patch

https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856 No Types Assigned

https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856 Patch

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()

When unregister pd capabilitie in tcpm, KASAN will capture below double
-free issue. The root cause is the same capabilitiy will be kfreed twice,
the first time is kfreed by pd_capabilities_release() and the second time
is explicitly kfreed by tcpm_port_unregister_pd().

[    3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc
[    3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10
[    4.001206]
[    4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53
[    4.012402] Hardware name: Freescale i.MX8QXP MEK (DT)
[    4.017569] Workqueue: events_unbound deferred_probe_work_func
[    4.023456] Call trace:
[    4.025920]  dump_backtrace+0x94/0xec
[    4.029629]  show_stack+0x18/0x24
[    4.032974]  dump_stack_lvl+0x78/0x90
[    4.036675]  print_report+0xfc/0x5c0
[    4.040289]  kasan_report_invalid_free+0xa0/0xc0
[    4.044937]  __kasan_slab_free+0x124/0x154
[    4.049072]  kfree+0xb4/0x1e8
[    4.052069]  tcpm_port_unregister_pd+0x1a4/0x3dc
[    4.056725]  tcpm_register_port+0x1dd0/0x2558
[    4.061121]  tcpci_register_port+0x420/0x71c
[    4.065430]  tcpci_probe+0x118/0x2e0

To fix the issue, this will remove kree() from tcpm_port_unregister_pd().

kernel.org https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69 [No types assigned]

kernel.org https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856 [No types assigned]