CVE-2024-36890: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(). 171 char *label __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(label)) { 173 dev_err(wm831x->dev, "Failed to duplicate label\n"); 174 continue; 175 } The auto clean up function should check for error pointers as well, otherwise we're going to keep hitting issues like this.

Is your site exposed to CVE-2024-36890?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-763 CWE-763

Affected Products

Vendor	Product	Versions
linux	linux_kernel	6.1.79 — 6.1.91
linux	linux_kernel	6.5 — 6.6.31
linux	linux_kernel	6.7 — 6.8.10
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543 https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2 https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128 https://git.kernel.org/stable/c/79cbe0be6c0317b215ddd8bd3e32f0afdac48543 https://git.kernel.org/stable/c/9f6eb0ab4f95240589ee85fd9886a944cd3645b2 https://git.kernel.org/stable/c/ac6cf3ce9b7d12acb7b528248df5f87caa25fcdc https://git.kernel.org/stable/c/cd7eb8f83fcf258f71e293f7fc52a70be8ed0128

Other References

https://git.kernel.org/stable/c/946771c2a2b1150f9b7286feadc3aa1e15a1eb16 https://git.kernel.org/stable/c/edca32f87329d6e341d2143a3b58ec254e8f6b88

Frequently Asked Questions

What is CVE-2024-36890? +

In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(). 171 char *label __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(label)) { 173 dev_err(wm831x->dev, "Failed to duplicate label\n"); 174 continue; 175 } The auto clean up function should check for error pointers as well, otherwise we're going to keep hitting issues like this. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-36890? +

CVE-2024-36890 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-36890? +

CVE-2024-36890 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-36890? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-13824

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault …

CVE-2024-44852 9.8

Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar::isUnsafeToPlan().

CVE-2026-52993 9.8

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the …

CVE-2025-25215 8.8

An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior …

CVE-2024-6607 8.8

It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a …

CVE-2023-43532 8.4

Memory corruption while reading ACPI config through the user mode app.

CVE-2024-36890