#VU90193 Use-after-free in Linux kernel - CVE-2024-26875

Vulnerability identifier: #VU90193

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26875

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pvr2_context_exit() function in drivers/media/usb/pvrusb2/pvrusb2-context.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/ed8000e1e8e9684ab6c30cf2b526c0cea039929c
https://git.kernel.org/stable/c/d29ed08964cec8b9729bc55c7bb23f679d7a18fb
https://git.kernel.org/stable/c/ab896d93fd6a2cd1afeb034c3cc9226cb499209f
https://git.kernel.org/stable/c/eb6e9dce979c08210ff7249e5e0eceb8991bfcd7
https://git.kernel.org/stable/c/3a1ec89708d2e57e2712f46241282961b1a7a475
https://git.kernel.org/stable/c/8e60b99f6b7ccb3badeb512f5eb613ad45904592
https://git.kernel.org/stable/c/40cd818fae875c424a8335009db33c7b5a07de3a
https://git.kernel.org/stable/c/eaa410e05bdf562c90b23cdf2d9327f9c4625e16
https://git.kernel.org/stable/c/0a0b79ea55de8514e1750884e5fec77f9fdd01ee

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.