CVE-2024-53213: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-27 · updated 2026-06-17
Weakness: CWE-415

Description

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation In lan78xx_probe(), the buffer `buf` was being freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` with the `URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused a double free issue. To resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to simplify the initialization sequence and removed the redundant `kfree(buf)`. Now, `buf` is allocated after `usb_alloc_urb()`, ensuring it is correctly managed by `usb_fill_int_urb()` and freed by `usb_free_urb()` as intended.

Affected products

Linux kernel: from 5.17 before 6.1.120; from 6.2 before 6.6.64; from 6.7 before 6.11.11; from 6.12 before 6.12.2 — fixed in 6.1.120, 6.11.11, 6.12.2, 6.6.64

How to fix

Upgrade to a fixed version: Linux kernel 6.1.120, 6.11.11, 6.12.2, 6.6.64. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-53213 or the next vulnerability affects your stack