CVE-2024-56561

Summary

CVE-2024-56561 is a vulnerability affecting the Linux kernel that has been addressed. In pci_epc_destroy(), the PCI domain ID was being released using pci_bus_release_domain_nr(), but this function was being passed a device pointer ('epc->dev') that had already been freed in device_unregister(). This led to a use-after-free issue. Additionally, the domain ID being released corresponded to the EPC device parent, making the passed device pointer incorrect. The vulnerability has been mitigated by changing the argument in pci_bus_release_domain_nr() to 'epc->dev.parent' and ensuring this is done before device_unregister().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.