{
  "cveId": "CVE-2024-26875",
  "url": "https://patchblox.com/security/cve/CVE-2024-26875",
  "summary": "CVE-2024-26875 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-26875, released April 17, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  media: pvrusb2: fix uaf in pvr2_context_set_noti...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  media: pvrusb2: fix uaf in pvr2_context_set_notify  [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify\u002B0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26  CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace:  \u003CTASK\u003E  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl\u002B0xd9/0x1b0 lib/dump_stack.c:106  print_address_description mm/kasan/report.c:377 [inline]  print_report\u002B0xc4/0x620 mm/kasan/report.c:488  kasan_report\u002B0xda/0x110 mm/kasan/report.c:601  pvr2_context_set_notify\u002B0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35  pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]  pvr2_context_disconnect\u002B0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272  Freed by task 906: kasan_save_stack\u002B0x33/0x50 mm/kasan/common.c:47 kasan_save_track\u002B0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info\u002B0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free\u002B0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree\u002B0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func\u002B0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158  [Analyze] Task A set disconnect_flag = !0, which resulted in Task B\u0027s condition being met and releasing mp, leading to this issue.  [Fix] Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid this issue.",
  "published": "2024-04-17T11:15:09Z",
  "severity": "medium",
  "cvss": 6.4,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00247,
  "epssPercentile": 0.16032,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.85-1",
      "fix": "DEBIAN-CVE-2024-26875",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26875",
      "released": "2024-04-17T11:15:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.7.12-1",
      "fix": "DEBIAN-CVE-2024-26875",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26875",
      "released": "2024-04-17T11:15:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.7.12-1",
      "fix": "DEBIAN-CVE-2024-26875",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26875",
      "released": "2024-04-17T11:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}