GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36890 (GCVE-0-2024-36890)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:28 – Updated: 2026-08-05 11:31
VLAI
Title
mm/slab: make __free(kfree) accept error pointers
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(). 171 char *label __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(label)) { 173 dev_err(wm831x->dev, "Failed to duplicate label\n"); 174 continue; 175 } The auto clean up function should check for error pointers as well, otherwise we're going to keep hitting issues like this.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-06 18:34 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: af53aaf20722d745a69a051114a1ae237f5b922e , < edca32f87329d6e341d2143a3b58ec254e8f6b88 (git)
Affected: f550466949e822afcd0b546a4fc35795930660bc , < 946771c2a2b1150f9b7286feadc3aa1e15a1eb16 (git)
Affected: 3c6cc62ce1265aa5623e2e1b29c0fe258bf6e232 , < 9f6eb0ab4f95240589ee85fd9886a944cd3645b2 (git)
Affected: 54da6a0924311c7cf5015533991e44fb8eb12773 , < ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc (git)
Affected: 54da6a0924311c7cf5015533991e44fb8eb12773 , < 79cbe0be6c0317b215ddd8bd3e32f0afdac48543 (git)
Affected: 54da6a0924311c7cf5015533991e44fb8eb12773 , < cd7eb8f83fcf258f71e293f7fc52a70be8ed0128 (git)
Affected: 6.1.79 , < 6.1.91 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:34:10.099765Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T18:34:28.352Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:49.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/slab.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "edca32f87329d6e341d2143a3b58ec254e8f6b88",
              "status": "affected",
              "version": "af53aaf20722d745a69a051114a1ae237f5b922e",
              "versionType": "git"
            },
            {
              "lessThan": "946771c2a2b1150f9b7286feadc3aa1e15a1eb16",
              "status": "affected",
              "version": "f550466949e822afcd0b546a4fc35795930660bc",
              "versionType": "git"
            },
            {
              "lessThan": "9f6eb0ab4f95240589ee85fd9886a944cd3645b2",
              "status": "affected",
              "version": "3c6cc62ce1265aa5623e2e1b29c0fe258bf6e232",
              "versionType": "git"
            },
            {
              "lessThan": "ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc",
              "status": "affected",
              "version": "54da6a0924311c7cf5015533991e44fb8eb12773",
              "versionType": "git"
            },
            {
              "lessThan": "79cbe0be6c0317b215ddd8bd3e32f0afdac48543",
              "status": "affected",
              "version": "54da6a0924311c7cf5015533991e44fb8eb12773",
              "versionType": "git"
            },
            {
              "lessThan": "cd7eb8f83fcf258f71e293f7fc52a70be8ed0128",
              "status": "affected",
              "version": "54da6a0924311c7cf5015533991e44fb8eb12773",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.91",
              "status": "affected",
              "version": "6.1.79",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/slab.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "6.1.79",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: make __free(kfree) accept error pointers\n\nCurrently, if an automatically freed allocation is an error pointer that\nwill lead to a crash.  An example of this is in wm831x_gpio_dbg_show().\n\n   171\tchar *label __free(kfree) = gpiochip_dup_line_label(chip, i);\n   172\tif (IS_ERR(label)) {\n   173\t\tdev_err(wm831x-\u003edev, \"Failed to duplicate label\\n\");\n   174\t\tcontinue;\n   175  }\n\nThe auto clean up function should check for error pointers as well,\notherwise we\u0027re going to keep hitting issues like this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable cleanup handler is reached by a local `read()` of the debugfs files `/sys/kernel/debug/gpio` or `/sys/kernel/debug/pinctrl/*/pins`, which dispatch to the affected `dbg_show` callbacks. There is no network or remote path into any `__free(kfree)` site that can receive an error pointer.\nAC:L - Both sides of the trigger are attacker-controlled: the attacker drives system memory pressure to make `kstrdup()` in `gpiochip_dup_line_label()` return `ERR_PTR(-ENOMEM)` while repeatedly reading the debugfs file in a loop, and the resulting bad pointer value is fixed and deterministic rather than layout-dependent.\nPR:L - The kernel creates the gpio debugfs entry mode 0444 under a 0755 debugfs root, so on the many embedded, Android and industrial images that mount debugfs permissively an ordinary unprivileged local account can read it; no capability check exists on the path.\nUI:N - The attacker performs the debugfs read and the memory-pressure generation entirely on their own; no victim process, mount, or administrator action is required.\nS:U - The corruption is confined to the kernel\u0027s own slab allocator and page refcounts within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `kfree()` resolves the error pointer to a real populated `struct page` and either drops a refcount on an unrelated live page or splices a wild pointer onto a live slab freelist, so a subsequent allocation can hand out a pointer aliasing arbitrary kernel memory and disclose its contents.\nI:H - The same slab freelist poisoning gives a controlled kernel write when the wild pointer is later returned by `kmalloc()` and written to, and `folio_put()` on an in-use folio yields a page-level use-after-free \u2014 both are standard primitives for control-flow hijack.\nA:H - In the common case `virt_to_folio()` on `ERR_PTR(-ENOMEM)` dereferences bogus page metadata and the subsequent free corrupts allocator state, producing an immediate oops or a later panic, and it can be re-triggered on every read of the debugfs file."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:52.212Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/edca32f87329d6e341d2143a3b58ec254e8f6b88"
        },
        {
          "url": "https://git.kernel.org/stable/c/946771c2a2b1150f9b7286feadc3aa1e15a1eb16"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128"
        }
      ],
      "title": "mm/slab: make __free(kfree) accept error pointers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36890",
    "datePublished": "2024-05-30T15:28:57.373Z",
    "dateReserved": "2024-05-30T15:25:07.065Z",
    "dateUpdated": "2026-08-05T11:31:52.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36890",
      "date": "2026-09-16",
      "epss": "0.00235",
      "percentile": "0.14623"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab: make __free(kfree) accept error pointers\\n\\nCurrently, if an automatically freed allocation is an error pointer that\\nwill lead to a crash.  An example of this is in wm831x_gpio_dbg_show().\\n\\n   171\\tchar *label __free(kfree) = gpiochip_dup_line_label(chip, i);\\n   172\\tif (IS_ERR(label)) {\\n   173\\t\\tdev_err(wm831x-\u003edev, \\\"Failed to duplicate label\\\\n\\\");\\n   174\\t\\tcontinue;\\n   175  }\\n\\nThe auto clean up function should check for error pointers as well,\\notherwise we\u0027re going to keep hitting issues like this.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slab: make __free(kfree) acepta punteros de error Actualmente, si una asignaci\\u00f3n liberada autom\\u00e1ticamente es un puntero de error que provocar\\u00e1 un bloqueo. Un ejemplo de esto est\\u00e1 en wm831x_gpio_dbg_show(). 171 caracteres *etiqueta __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(etiqueta)) { 173 dev_err(wm831x-\u0026gt;dev, \\\"Error al duplicar la etiqueta\\\\n\\\"); 174 contin\\u00faan; 175 } La funci\\u00f3n de limpieza autom\\u00e1tica tambi\\u00e9n deber\\u00eda comprobar si hay indicadores de error; de lo contrario, seguiremos teniendo problemas como este.\"}]",
      "id": "CVE-2024-36890",
      "lastModified": "2024-11-21T09:22:44.687",
      "published": "2024-05-30T16:15:12.493",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36890\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:12.493\",\"lastModified\":\"2026-08-04T11:18:27.523\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab: make __free(kfree) accept error pointers\\n\\nCurrently, if an automatically freed allocation is an error pointer that\\nwill lead to a crash.  An example of this is in wm831x_gpio_dbg_show().\\n\\n   171\\tchar *label __free(kfree) = gpiochip_dup_line_label(chip, i);\\n   172\\tif (IS_ERR(label)) {\\n   173\\t\\tdev_err(wm831x-\u003edev, \\\"Failed to duplicate label\\\\n\\\");\\n   174\\t\\tcontinue;\\n   175  }\\n\\nThe auto clean up function should check for error pointers as well,\\notherwise we\u0027re going to keep hitting issues like this.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slab: make __free(kfree) acepta punteros de error Actualmente, si una asignaci\u00f3n liberada autom\u00e1ticamente es un puntero de error que provocar\u00e1 un bloqueo. Un ejemplo de esto est\u00e1 en wm831x_gpio_dbg_show(). 171 caracteres *etiqueta __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(etiqueta)) { 173 dev_err(wm831x-\u0026gt;dev, \\\"Error al duplicar la etiqueta\\\\n\\\"); 174 contin\u00faan; 175 } La funci\u00f3n de limpieza autom\u00e1tica tambi\u00e9n deber\u00eda comprobar si hay indicadores de error; de lo contrario, seguiremos teniendo problemas como este.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/slab.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"af53aaf20722d745a69a051114a1ae237f5b922e\",\"lessThan\":\"edca32f87329d6e341d2143a3b58ec254e8f6b88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f550466949e822afcd0b546a4fc35795930660bc\",\"lessThan\":\"946771c2a2b1150f9b7286feadc3aa1e15a1eb16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c6cc62ce1265aa5623e2e1b29c0fe258bf6e232\",\"lessThan\":\"9f6eb0ab4f95240589ee85fd9886a944cd3645b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54da6a0924311c7cf5015533991e44fb8eb12773\",\"lessThan\":\"ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54da6a0924311c7cf5015533991e44fb8eb12773\",\"lessThan\":\"79cbe0be6c0317b215ddd8bd3e32f0afdac48543\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54da6a0924311c7cf5015533991e44fb8eb12773\",\"lessThan\":\"cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.79\",\"lessThan\":\"6.1.91\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/slab.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.91\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-06T18:34:10.099765Z\",\"id\":\"CVE-2024-36890\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-763\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.79\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"C3AC03E4-5FB1-4289-ADD7-C4D83F763978\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"9CB26EA3-7B5D-4DF3-9158-7496BD09926F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"91326417-E981-482E-A5A3-28BC1327521B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAECDCD8-F556-4606-8D7B-5C6D47A501F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/946771c2a2b1150f9b7286feadc3aa1e15a1eb16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edca32f87329d6e341d2143a3b58ec254e8f6b88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:15+00:00",
      "cve": "CVE-2024-36890",
      "id": "CVE-2024-36890",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/slab: make __free(kfree) accept error pointers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36890.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:35:39Z",
      "cve": "CVE-2024-36890",
      "id": "CVE-2024-36890",
      "initial_release_date": "2024-06-01T02:23:46Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "273",
      "product_status:recommended": "651",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36890",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36890.json",
      "version": "84"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:49.148Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36890\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-06T18:34:10.099765Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-06T18:34:25.566Z\"}}], \"cna\": {\"title\": \"mm/slab: make __free(kfree) accept error pointers\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable cleanup handler is reached by a local `read()` of the debugfs files `/sys/kernel/debug/gpio` or `/sys/kernel/debug/pinctrl/*/pins`, which dispatch to the affected `dbg_show` callbacks. There is no network or remote path into any `__free(kfree)` site that can receive an error pointer.\\nAC:L - Both sides of the trigger are attacker-controlled: the attacker drives system memory pressure to make `kstrdup()` in `gpiochip_dup_line_label()` return `ERR_PTR(-ENOMEM)` while repeatedly reading the debugfs file in a loop, and the resulting bad pointer value is fixed and deterministic rather than layout-dependent.\\nPR:L - The kernel creates the gpio debugfs entry mode 0444 under a 0755 debugfs root, so on the many embedded, Android and industrial images that mount debugfs permissively an ordinary unprivileged local account can read it; no capability check exists on the path.\\nUI:N - The attacker performs the debugfs read and the memory-pressure generation entirely on their own; no victim process, mount, or administrator action is required.\\nS:U - The corruption is confined to the kernel\u0027s own slab allocator and page refcounts within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `kfree()` resolves the error pointer to a real populated `struct page` and either drops a refcount on an unrelated live page or splices a wild pointer onto a live slab freelist, so a subsequent allocation can hand out a pointer aliasing arbitrary kernel memory and disclose its contents.\\nI:H - The same slab freelist poisoning gives a controlled kernel write when the wild pointer is later returned by `kmalloc()` and written to, and `folio_put()` on an in-use folio yields a page-level use-after-free \\u2014 both are standard primitives for control-flow hijack.\\nA:H - In the common case `virt_to_folio()` on `ERR_PTR(-ENOMEM)` dereferences bogus page metadata and the subsequent free corrupts allocator state, producing an immediate oops or a later panic, and it can be re-triggered on every read of the debugfs file.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"af53aaf20722d745a69a051114a1ae237f5b922e\", \"lessThan\": \"edca32f87329d6e341d2143a3b58ec254e8f6b88\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f550466949e822afcd0b546a4fc35795930660bc\", \"lessThan\": \"946771c2a2b1150f9b7286feadc3aa1e15a1eb16\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3c6cc62ce1265aa5623e2e1b29c0fe258bf6e232\", \"lessThan\": \"9f6eb0ab4f95240589ee85fd9886a944cd3645b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"54da6a0924311c7cf5015533991e44fb8eb12773\", \"lessThan\": \"ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"54da6a0924311c7cf5015533991e44fb8eb12773\", \"lessThan\": \"79cbe0be6c0317b215ddd8bd3e32f0afdac48543\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"54da6a0924311c7cf5015533991e44fb8eb12773\", \"lessThan\": \"cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.1.79\", \"lessThan\": \"6.1.91\", \"versionType\": \"semver\"}], \"programFiles\": [\"include/linux/slab.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/slab.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/edca32f87329d6e341d2143a3b58ec254e8f6b88\"}, {\"url\": \"https://git.kernel.org/stable/c/946771c2a2b1150f9b7286feadc3aa1e15a1eb16\"}, {\"url\": \"https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2\"}, {\"url\": \"https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc\"}, {\"url\": \"https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543\"}, {\"url\": \"https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/slab: make __free(kfree) accept error pointers\\n\\nCurrently, if an automatically freed allocation is an error pointer that\\nwill lead to a crash.  An example of this is in wm831x_gpio_dbg_show().\\n\\n   171\\tchar *label __free(kfree) = gpiochip_dup_line_label(chip, i);\\n   172\\tif (IS_ERR(label)) {\\n   173\\t\\tdev_err(wm831x-\u003edev, \\\"Failed to duplicate label\\\\n\\\");\\n   174\\t\\tcontinue;\\n   175  }\\n\\nThe auto clean up function should check for error pointers as well,\\notherwise we\u0027re going to keep hitting issues like this.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"6.1.79\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:52.212Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36890\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:52.212Z\", \"dateReserved\": \"2024-05-30T15:25:07.065Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:28:57.373Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.