CVE-2024-26749

Summary

CVE-2024-26749 is a use-after-free vulnerability affecting the Linux kernel's USB CDNs3 driver. The issue lies in the function cdns3_gadget_ep_disable(), where the list_del_init() function is called before freeing the memory of 'priv_req'. This sequence results in an attempt to use 'priv_req' after it has been freed, leading to a use-after-free read. The consequence is a kernel panic with message "BUG: KFENCE: use-after-free read". To resolve the problem, the order of the function calls should be reversed, moving list_del_init() before cdns3_gadget_ep_free_request().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.