# CVE-2024-46746: linux: In the Linux kernel, the following vulnerability has been resolved:  HID: amd_sfh: free driver_data after destroying...

CVE-2024-46746 is fixed in 40 products on 1 platform, first by DEBIAN-CVE-2024-46746, released September 18, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-46746
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 18, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  HID: amd_sfh: free driver_data after destroying hid device  HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks.  I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output:    [   13.050438] ==================================================================   [   13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]   [   13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3   [   13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479    [   13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0   [   13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024   [   13.067860] Call Trace:   [   13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8   [   13.071486]  <TASK>   [   13.071492]  dump_stack_lvl+0x5d/0x80   [   13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002)   [   13.078296]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.082199]  print_report+0x174/0x505   [   13.085776]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10   [   13.089367]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.093255]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.097464]  kasan_report+0xc8/0x150   [   13.101461]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.105802]  amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.110303]  amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.114879]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.119450]  sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]   [   13.124097]  hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]   [   13.127404]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.131925]  ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]   [   13.136455]  ? _raw_spin_lock_irqsave+0x96/0xf0   [   13.140197]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10   [   13.143602]  ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]   [   13.147234]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.150446]  ? __devm_add_action+0x167/0x1d0   [   13.155061]  hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]   [   13.158581]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.161814]  platform_probe+0xa2/0x150   [   13.165029]  really_probe+0x1e3/0x8a0   [   13.168243]  __driver_probe_device+0x18c/0x370   [   13.171500]  driver_probe_device+0x4a/0x120   [   13.175000]  __driver_attach+0x190/0x4a0   [   13.178521]  ? __pfx___driver_attach+0x10/0x10   [   13.181771]  bus_for_each_dev+0x106/0x180   [   13.185033]  ? __pfx__raw_spin_lock+0x10/0x10   [   13.188229]  ? __pfx_bus_for_each_dev+0x10/0x10   [   13.191446]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.194382]  bus_add_driver+0x29e/0x4d0   [   13.197328]  driver_register+0x1a5/0x360   [   13.200283]  ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]   [   13.203362]  do_one_initcall+0xa7/0x380   [   13.206432]  ? __pfx_do_one_initcall+0x10/0x10   [   13.210175]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.213211]  ? kasan_unpoison+0x44/0x70   [   13.216688]  do_init_module+0x238/0x750   [   13.2196 ---truncated---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bpftool ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | bpftool ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | dtb-aarch64 opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-64kb opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-64kb sles 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-azure opensuse-leap 15.6 | 6.4.0-150600.8.14.1 | [SUSE-SU-2024:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3551-1.md) | Oct 8, 2024 |
| Linux | kernel-azure sles 15.6 | 6.4.0-150600.8.14.1 | [SUSE-SU-2024:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3551-1.md) | Oct 8, 2024 |
| Linux | kernel-coco sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-coco_debug sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-debug opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-default opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-default sles 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-default-base opensuse-leap 15.6 | 6.4.0-150600.23.25.1.150600.12.10.2 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-default-base sles 15.6 | 6.4.0-150600.23.25.1.150600.12.10.2 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-docs opensuse-leap 15.6 | 6.4.0-150600.23.25.2 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-docs sles 15.6 | 6.4.0-150600.23.25.2 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-kvmsmall opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-livepatch-SLE15-SP6-RT_Update_4 sles 15.6 | 1-150600.1.3.1 | [SUSE-SU-2024:3564-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3564-1.md) | Oct 9, 2024 |
| Linux | kernel-livepatch-SLE15-SP6_Update_5 sles 15.6 | 1-150600.13.3.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-obs-build opensuse-leap 15.6 | 6.4.0-150600.23.25.2 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-obs-build sles 15.6 | 6.4.0-150600.23.25.2 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-obs-qa opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-rt opensuse-leap 15.6 | 6.4.0-150600.10.14.1 | [SUSE-SU-2024:3564-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3564-1.md) | Oct 9, 2024 |
| Linux | kernel-rt_debug opensuse-leap 15.6 | 6.4.0-150600.10.14.1 | [SUSE-SU-2024:3564-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3564-1.md) | Oct 9, 2024 |
| Linux | kernel-source opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-source sles 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-source-azure opensuse-leap 15.6 | 6.4.0-150600.8.14.1 | [SUSE-SU-2024:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3551-1.md) | Oct 8, 2024 |
| Linux | kernel-source-azure sles 15.6 | 6.4.0-150600.8.14.1 | [SUSE-SU-2024:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3551-1.md) | Oct 8, 2024 |
| Linux | kernel-source-coco sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-source-rt opensuse-leap 15.6 | 6.4.0-150600.10.14.1 | [SUSE-SU-2024:3564-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3564-1.md) | Oct 9, 2024 |
| Linux | kernel-syms opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-syms sles 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-syms-azure opensuse-leap 15.6 | 6.4.0-150600.8.14.1 | [SUSE-SU-2024:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3551-1.md) | Oct 8, 2024 |
| Linux | kernel-syms-azure sles 15.6 | 6.4.0-150600.8.14.1 | [SUSE-SU-2024:3551-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3551-1.md) | Oct 8, 2024 |
| Linux | kernel-syms-coco sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-syms-rt opensuse-leap 15.6 | 6.4.0-150600.10.14.1 | [SUSE-SU-2024:3564-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3564-1.md) | Oct 9, 2024 |
| Linux | kernel-uek ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-container ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-container ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-container-debug ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-container-debug ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-core ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-core ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-core ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-core ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-devel ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-devel ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-modules ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-modules ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-modules-extra ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-debug-modules-extra ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-devel ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-devel ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-doc ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-doc ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-modules ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-modules ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-modules-extra ol 8 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-uek-modules-extra ol 9 | 0:5.15.0-302.167.6.el9uek | [ELSA-2024-12815](https://patchblox.com/security/data/fix/linux/elsa-2024-12815.md) | Nov 11, 2024 |
| Linux | kernel-zfcpdump opensuse-leap 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | kernel-zfcpdump sles 15.6 | 6.4.0-150600.23.25.1 | [SUSE-SU-2024:3561-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3561-1.md) | Oct 9, 2024 |
| Linux | linux Debian 12.15 (bookworm) | 6.1.112-1 | [DEBIAN-CVE-2024-46746](https://patchblox.com/security/data/fix/linux/debian-cve-2024-46746.md) | Sep 18, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.10.11-1 | [DEBIAN-CVE-2024-46746](https://patchblox.com/security/data/fix/linux/debian-cve-2024-46746.md) | Sep 18, 2024 |
| Linux | linux Debian 14 | 6.10.11-1 | [DEBIAN-CVE-2024-46746](https://patchblox.com/security/data/fix/linux/debian-cve-2024-46746.md) | Sep 18, 2024 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.