{"id":"CVE-2024-50055","state":"PUBLISHED","title":"driver core: bus: Fix double free in driver API bus_register()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: bus: Fix double free in driver API bus_register()\n\nFor bus_register(), any error which happens after kset_register() will\ncause that @priv are freed twice, fixed by setting @priv with NULL after\nthe first free.","publishedAt":"2024-10-21T19:39:46.476Z","updatedAt":"2026-08-05T11:41:17.222Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","status":"affected","lessThan":"d885c464c25018b81a6b58f5d548fc2e3ef87dd1","versionType":"git"},{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","status":"affected","lessThan":"9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a","versionType":"git"},{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","status":"affected","lessThan":"bfa54a793ba77ef696755b66f3ac4ed00c7d1248","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/base/bus.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.6.57","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.4","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/base/bus.c"]}],"references":["https://git.kernel.org/stable/c/d885c464c25018b81a6b58f5d548fc2e3ef87dd1","https://git.kernel.org/stable/c/9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a","https://git.kernel.org/stable/c/bfa54a793ba77ef696755b66f3ac4ed00c7d1248","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/50xxx/CVE-2024-50055.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-50055","state":"PUBLISHED","datePublished":"2024-10-21T19:39:46.476Z","dateUpdated":"2026-08-05T11:41:17.222Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-10-21T19:36:19.938Z"},"containers":{"cna":{"title":"driver core: bus: Fix double free in driver API bus_register()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: bus: Fix double free in driver API bus_register()\n\nFor bus_register(), any error which happens after kset_register() will\ncause that @priv are freed twice, fixed by setting @priv with NULL after\nthe first free."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","status":"affected","lessThan":"d885c464c25018b81a6b58f5d548fc2e3ef87dd1","versionType":"git"},{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","status":"affected","lessThan":"9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a","versionType":"git"},{"version":"3465e2e4a24eef9bc9f21aa29d83fd7000c1da48","status":"affected","lessThan":"bfa54a793ba77ef696755b66f3ac4ed00c7d1248","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/base/bus.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.6.57","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.4","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/base/bus.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d885c464c25018b81a6b58f5d548fc2e3ef87dd1"},{"url":"https://git.kernel.org/stable/c/9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a"},{"url":"https://git.kernel.org/stable/c/bfa54a793ba77ef696755b66f3ac4ed00c7d1248"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - `bus_register()` is a driver-core API invoked only from subsystem initialization running on the local machine; the unprivileged trigger is a local `socket(AF_NETLINK, SOCK_RAW, NETLINK_ISCSI)` syscall that forces module autoload. No remote peer, network packet, or physical device is involved.\nAC:L - The attacker can drive the system into memory pressure and then repeatedly force `scsi_transport_iscsi` autoload, because a failed module init leaves the netlink protocol unregistered so the request_module can be replayed without limit until an allocation inside `bus_register()` fails. Nothing about the trigger depends on state outside the attacker's influence, and the two `kfree()` calls then execute back-to-back deterministically.\nPR:L - `netlink_create()` performs `request_module(\"net-pf-16-proto-8\")` with no capability check at all, so an ordinary unprivileged user reaches `iscsi_transport_init()` → `bus_register(&iscsi_flashnode_bus)` with a single socket() call. No CAP_SYS_MODULE, no root, and no user-namespace trickery is needed for this path.\nUI:N - The attacker performs every step itself — create memory pressure, issue the socket() call that triggers autoload — with no victim action, mount, file open, or administrator involvement required.\nS:U - The corrupted object is a kernel slab allocation and the consequences stay entirely within the kernel's own security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The double free makes the SLUB freelist self-referential so two later allocations of the same size class alias one address, giving type confusion between attacker-controlled and kernel objects and thus an arbitrary kernel-memory read primitive. Freed-object contents can be reclaimed and disclosed through the aliased structure.\nI:H - The same freelist aliasing lets an attacker-sprayed object overwrite the fields of an unrelated live kernel structure — including function pointers reachable from `struct subsys_private`-sized kmalloc objects — yielding an arbitrary write and control-flow hijack primitive, i.e. full local privilege escalation.\nA:H - Even without successful exploitation the double free corrupts the slab allocator and panics the machine; on kernels built with CONFIG_SLAB_FREELIST_HARDENED the `BUG_ON(object == fp)` in `set_freepointer()` fires immediately, and `bus_release()` additionally calls `lockdep_unregister_key()` on a never-registered key on the early error paths."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:41:17.222Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.11.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-50055","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-22T13:23:36.877414Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T13:28:43.087Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:43:22.001Z"}}]}}}