CVE-2024-26748

Summary

CVE-2024-26748 is a use-after-free vulnerability found in the Linux kernel's cdns3 driver. The issue arises due to a double free condition when handling zero-length packets. The driver inadvertently frees a request twice, once with usb_gadget_giveback_request() and again with cdns3_gadget_ep_free_request(). This leads to a use-after-free read, as documented in the kernel logs. To mitigate this vulnerability, the code at line 829 should include a check to skip the call to usb_gadget_giveback_request() for additional zero-length packet requests, as they are already allocated within the driver.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.