CVE-2024-49874i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
- 7.8HighCVSS base score
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition In the svc_i3c_master_probe function, &master->hj_work is bound with svc_i3c_master_hj_work, &master->ibi_work is bound with svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work can start the hj_work, svc_i3c_master_irq_handler can start the ibi_work. If we remove the module which will call svc_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | svc_i3c_master_hj_work svc_i3c_master_remove | i3c_master_unregister(&master->base)| device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in svc_i3c_master_remove.
Timeline
ID reserved
By Linux
Published
- 22 months later
· 22 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 87e0f28eda36c7843523aa8dd0c5dab3331e9718 – < 56bddf543d4d7ddeff3f87b554ddacfdf086bffe
- affected 0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7 – < 4ac637122930cc4ab7e2c22e364cf3aaf96b05b1
- affected 0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7 – < 4318998892bf8fe99f97bea18c37ae7b685af75a
- affected 0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7 – < 27b55724d3f781dd6e635e89dc6e2fd78fa81a00
- affected 0f74f8b6675cc36d689abb4d9b3d75ab4049b7d7 – < 61850725779709369c7e907ae8c7c75dc7cec4f3
- affected 6.4
- unaffected < 6.4
- unaffected 6.6.55 – ≤ 6.6.*
- unaffected 6.10.14 – ≤ 6.10.*
- unaffected 6.11.3 – ≤ 6.11.*
- unaffected 6.12 – ≤ *
References
References5
- https://git.kernel.org/stable/c/56bddf543d4d7ddeff3f87b554ddacfdf086bffe (opens in a new tab)
- https://git.kernel.org/stable/c/4ac637122930cc4ab7e2c22e364cf3aaf96b05b1 (opens in a new tab)
- https://git.kernel.org/stable/c/4318998892bf8fe99f97bea18c37ae7b685af75a (opens in a new tab)
- https://git.kernel.org/stable/c/27b55724d3f781dd6e635e89dc6e2fd78fa81a00 (opens in a new tab)
- https://git.kernel.org/stable/c/61850725779709369c7e907ae8c7c75dc7cec4f3 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-43836 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-49874)Record last updated .