CVE-2024-56576 (GCVE-0-2024-56576)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:23 – Updated: 2026-08-05 11:45
VLAI
Title
media: i2c: tc358743: Fix crash in the probe error path when using polling
Summary
In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix crash in the probe error path when using polling If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise the timer is called with arguments that are already freed, which results in a crash. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268 Modules linked in: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268 sp : ffffff80eff2baf0 x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00 x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00 x23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000 x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000 x11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009 x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480 x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240 x2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0 Call trace:  __run_timers+0x244/0x268  timer_expire_remote+0x50/0x68  tmigr_handle_remote+0x388/0x39c  run_timer_softirq+0x38/0x44  handle_softirqs+0x138/0x298  __do_softirq+0x14/0x20  ____do_softirq+0x10/0x1c  call_on_irq_stack+0x24/0x4c  do_softirq_own_stack+0x1c/0x2c  irq_exit_rcu+0x9c/0xcc  el1_interrupt+0x48/0xc0  el1h_64_irq_handler+0x18/0x24  el1h_64_irq+0x7c/0x80  default_idle_call+0x34/0x68  do_idle+0x23c/0x294  cpu_startup_entry+0x38/0x3c  secondary_start_kernel+0x128/0x160  __secondary_switched+0xb8/0xbc ---[ end trace 0000000000000000 ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < 13193a97ddd5a6a5b11408ddbc1ae85588b1860c (git)
Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < 5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea (git)
Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < 815d14147068347e88c258233eb951b41b2792a6 (git)
Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < 34a3466a92f50c51d984f0ec2e96864886d460eb (git)
Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < b59ab89bc83f7bff67f78c6caf484a84a6dd30f7 (git)
Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < 1def915b1564f4375330bd113ea1d768a569cfd8 (git)
Affected: 4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a , < 869f38ae07f7df829da4951c3d1f7a2be09c2e9a (git)
Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.12.4 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:49:52.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/tc358743.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13193a97ddd5a6a5b11408ddbc1ae85588b1860c",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            },
            {
              "lessThan": "5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            },
            {
              "lessThan": "815d14147068347e88c258233eb951b41b2792a6",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            },
            {
              "lessThan": "34a3466a92f50c51d984f0ec2e96864886d460eb",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            },
            {
              "lessThan": "b59ab89bc83f7bff67f78c6caf484a84a6dd30f7",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            },
            {
              "lessThan": "1def915b1564f4375330bd113ea1d768a569cfd8",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            },
            {
              "lessThan": "869f38ae07f7df829da4951c3d1f7a2be09c2e9a",
              "status": "affected",
              "version": "4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/tc358743.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.4",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: tc358743: Fix crash in the probe error path when using polling\n\nIf an error occurs in the probe() function, we should remove the polling\ntimer that was alarmed earlier, otherwise the timer is called with\narguments that are already freed, which results in a crash.\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268\nModules linked in:\nCPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226\nHardware name: Diasom DS-RK3568-SOM-EVB (DT)\npstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __run_timers+0x244/0x268\nlr : __run_timers+0x1d4/0x268\nsp : ffffff80eff2baf0\nx29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00\nx26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00\nx23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000\nx20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff\nx17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e\nx14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000\nx11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009\nx8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480\nx5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240\nx2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0\nCall trace:\n\u00a0__run_timers+0x244/0x268\n\u00a0timer_expire_remote+0x50/0x68\n\u00a0tmigr_handle_remote+0x388/0x39c\n\u00a0run_timer_softirq+0x38/0x44\n\u00a0handle_softirqs+0x138/0x298\n\u00a0__do_softirq+0x14/0x20\n\u00a0____do_softirq+0x10/0x1c\n\u00a0call_on_irq_stack+0x24/0x4c\n\u00a0do_softirq_own_stack+0x1c/0x2c\n\u00a0irq_exit_rcu+0x9c/0xcc\n\u00a0el1_interrupt+0x48/0xc0\n\u00a0el1h_64_irq_handler+0x18/0x24\n\u00a0el1h_64_irq+0x7c/0x80\n\u00a0default_idle_call+0x34/0x68\n\u00a0do_idle+0x23c/0x294\n\u00a0cpu_startup_entry+0x38/0x3c\n\u00a0secondary_start_kernel+0x128/0x160\n\u00a0__secondary_switched+0xb8/0xbc\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable object is an I\u00b2C sub-device state struct freed on the driver probe error path; reaching and exploiting it requires local presence on the machine (module load / driver bind, and a local heap-spray process to reclaim the freed slab). No network or remote-peer data reaches drivers/media/i2c/tc358743.c.\nAC:L - Polling mode (no IRQ line) is the ordinary shipping configuration for this bridge, and once the error path leaves the timer armed the use-after-free re-arms and re-fires itself every 1000 ms (250 ms with CEC), giving the attacker unlimited, repeatable attempts to reclaim the freed tc358743_state slab with controlled data \u2014 no condition outside the attacker\u0027s influence must line up.\nPR:L - The exploitable state is created by an ordinary probe failure (e.g. a transient allocation failure in cec_register_adapter()/v4l2_async_register_subdev(), which an unprivileged process can provoke via memory pressure), after which an unprivileged local user needs only normal syscalls to spray kmalloc slabs and reclaim the freed object that the orphan timer keeps dereferencing and writing to.\nUI:N - The orphan timer fires autonomously from softirq context on a repeating schedule with no victim action required; the attacker\u0027s heap grooming runs entirely from its own process.\nS:U - The freed memory, the timer wheel corruption and any resulting code execution are all within the kernel\u0027s own security authority; no hypervisor, IOMMU or sandbox boundary is crossed.\nC:H - KASAN confirms a slab use-after-free on a devm-freed tc358743_state; the timer callback and tc358743_isr() re-read state-\u003ecec_adap, state-\u003esd and the embedded work_struct/function pointers out of recycled memory, and the resulting control-flow hijack primitive yields arbitrary kernel memory disclosure.\nI:H - The report documents an 8-byte write into freed memory from __run_timer_base, and mod_timer()/schedule_work() write further into the freed object each cycle; because the timer core and the workqueue both call function pointers read out of that recycled slab, the bug is a control-flow-hijack / arbitrary-write primitive, not a read-only defect.\nA:H - The original report is a kernel WARN/oops in __run_timers (fatal under panic_on_warn), and the corrupted timer list plus repeated I\u00b2C access through a freed subdev reliably crashes the system, recurring every polling interval."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:09.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13193a97ddd5a6a5b11408ddbc1ae85588b1860c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/815d14147068347e88c258233eb951b41b2792a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/34a3466a92f50c51d984f0ec2e96864886d460eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b59ab89bc83f7bff67f78c6caf484a84a6dd30f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/1def915b1564f4375330bd113ea1d768a569cfd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/869f38ae07f7df829da4951c3d1f7a2be09c2e9a"
        }
      ],
      "title": "media: i2c: tc358743: Fix crash in the probe error path when using polling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56576",
    "datePublished": "2024-12-27T14:23:18.792Z",
    "dateReserved": "2024-12-27T14:03:05.999Z",
    "dateUpdated": "2026-08-05T11:45:09.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56576",
      "date": "2026-08-06",
      "epss": "0.00184",
      "percentile": "0.08169"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: i2c: tc358743: Fix crash in the probe error path when using polling\\n\\nIf an error occurs in the probe() function, we should remove the polling\\ntimer that was alarmed earlier, otherwise the timer is called with\\narguments that are already freed, which results in a crash.\\n\\n------------[ cut here ]------------\\nWARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268\\nModules linked in:\\nCPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226\\nHardware name: Diasom DS-RK3568-SOM-EVB (DT)\\npstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\npc : __run_timers+0x244/0x268\\nlr : __run_timers+0x1d4/0x268\\nsp : ffffff80eff2baf0\\nx29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00\\nx26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00\\nx23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000\\nx20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff\\nx17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e\\nx14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000\\nx11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009\\nx8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480\\nx5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240\\nx2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0\\nCall trace:\\n\\u00a0__run_timers+0x244/0x268\\n\\u00a0timer_expire_remote+0x50/0x68\\n\\u00a0tmigr_handle_remote+0x388/0x39c\\n\\u00a0run_timer_softirq+0x38/0x44\\n\\u00a0handle_softirqs+0x138/0x298\\n\\u00a0__do_softirq+0x14/0x20\\n\\u00a0____do_softirq+0x10/0x1c\\n\\u00a0call_on_irq_stack+0x24/0x4c\\n\\u00a0do_softirq_own_stack+0x1c/0x2c\\n\\u00a0irq_exit_rcu+0x9c/0xcc\\n\\u00a0el1_interrupt+0x48/0xc0\\n\\u00a0el1h_64_irq_handler+0x18/0x24\\n\\u00a0el1h_64_irq+0x7c/0x80\\n\\u00a0default_idle_call+0x34/0x68\\n\\u00a0do_idle+0x23c/0x294\\n\\u00a0cpu_startup_entry+0x38/0x3c\\n\\u00a0secondary_start_kernel+0x128/0x160\\n\\u00a0__secondary_switched+0xb8/0xbc\\n---[ end trace 0000000000000000 ]---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: i2c: tc358743: Se corrige el fallo en la ruta de error de la sonda al usar sondeo Si ocurre un error en la funci\\u00f3n probe(), debemos eliminar el temporizador de sondeo que se alarm\\u00f3 anteriormente, de lo contrario, el temporizador se llama con argumentos que ya est\\u00e1n liberados, lo que da como resultado un bloqueo. ------------[ cortar aqu\\u00ed ]------------ ADVERTENCIA: CPU: 3 PID: 0 en kernel/time/timer.c:1830 __run_timers+0x244/0x268 M\\u00f3dulos vinculados en: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 No contaminado 6.11.0 #226 Nombre del hardware: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268 sp : ffffff80eff2baf0 x29: ffffff80eff2bb50 x28: 7ffffffffffffffff x27: ffffff80eff2bb00 x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00 x23: 0000000000000000 x22: muerto000000000122 x21: 0000000000000000 x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000 x11: 00000000000639c0 x10: 000000000000000c x9: 0000000000000009 x8: ffffff80eff2cb40 x7: ffffff80eff2cb40 x6: ffffff8002bee480 x5: ffffffc080cb2220 x4: ffffffc080cb2150 x3: 00000000000f4240 x2: 0000000000000102 x1: ffffff80eff2bb00 x0 Rastreo de llamadas: __run_timers+0x244/0x268 timer_expire_remote+0x50/0x68 tmigr_handle_remote+0x388/0x39c run_timer_softirq+0x38/0x44 handle_softirqs+0x138/0x298 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x7c/0x80 llamada_inactiva_predeterminada+0x34/0x68 do_idle+0x23c/0x294 entrada_inicio_cpu+0x38/0x3c n\\u00facleo_inicio_secundario+0x128/0x160 __conmutaci\\u00f3n_secundaria+0xb8/0xbc ---[ fin de seguimiento 0000000000000000 ]---\"}]",
      "id": "CVE-2024-56576",
      "lastModified": "2024-12-27T15:15:16.657",
      "published": "2024-12-27T15:15:16.657",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/13193a97ddd5a6a5b11408ddbc1ae85588b1860c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1def915b1564f4375330bd113ea1d768a569cfd8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/34a3466a92f50c51d984f0ec2e96864886d460eb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/815d14147068347e88c258233eb951b41b2792a6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/869f38ae07f7df829da4951c3d1f7a2be09c2e9a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b59ab89bc83f7bff67f78c6caf484a84a6dd30f7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56576\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:16.657\",\"lastModified\":\"2026-08-04T11:22:11.470\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: i2c: tc358743: Fix crash in the probe error path when using polling\\n\\nIf an error occurs in the probe() function, we should remove the polling\\ntimer that was alarmed earlier, otherwise the timer is called with\\narguments that are already freed, which results in a crash.\\n\\n------------[ cut here ]------------\\nWARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268\\nModules linked in:\\nCPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226\\nHardware name: Diasom DS-RK3568-SOM-EVB (DT)\\npstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\npc : __run_timers+0x244/0x268\\nlr : __run_timers+0x1d4/0x268\\nsp : ffffff80eff2baf0\\nx29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00\\nx26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00\\nx23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000\\nx20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff\\nx17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e\\nx14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000\\nx11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009\\nx8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480\\nx5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240\\nx2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0\\nCall trace:\\n\u00a0__run_timers+0x244/0x268\\n\u00a0timer_expire_remote+0x50/0x68\\n\u00a0tmigr_handle_remote+0x388/0x39c\\n\u00a0run_timer_softirq+0x38/0x44\\n\u00a0handle_softirqs+0x138/0x298\\n\u00a0__do_softirq+0x14/0x20\\n\u00a0____do_softirq+0x10/0x1c\\n\u00a0call_on_irq_stack+0x24/0x4c\\n\u00a0do_softirq_own_stack+0x1c/0x2c\\n\u00a0irq_exit_rcu+0x9c/0xcc\\n\u00a0el1_interrupt+0x48/0xc0\\n\u00a0el1h_64_irq_handler+0x18/0x24\\n\u00a0el1h_64_irq+0x7c/0x80\\n\u00a0default_idle_call+0x34/0x68\\n\u00a0do_idle+0x23c/0x294\\n\u00a0cpu_startup_entry+0x38/0x3c\\n\u00a0secondary_start_kernel+0x128/0x160\\n\u00a0__secondary_switched+0xb8/0xbc\\n---[ end trace 0000000000000000 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: i2c: tc358743: Se corrige el fallo en la ruta de error de la sonda al usar sondeo Si ocurre un error en la funci\u00f3n probe(), debemos eliminar el temporizador de sondeo que se alarm\u00f3 anteriormente, de lo contrario, el temporizador se llama con argumentos que ya est\u00e1n liberados, lo que da como resultado un bloqueo. ------------[ cortar aqu\u00ed ]------------ ADVERTENCIA: CPU: 3 PID: 0 en kernel/time/timer.c:1830 __run_timers+0x244/0x268 M\u00f3dulos vinculados en: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 No contaminado 6.11.0 #226 Nombre del hardware: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268 sp : ffffff80eff2baf0 x29: ffffff80eff2bb50 x28: 7ffffffffffffffff x27: ffffff80eff2bb00 x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00 x23: 0000000000000000 x22: muerto000000000122 x21: 0000000000000000 x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000 x11: 00000000000639c0 x10: 000000000000000c x9: 0000000000000009 x8: ffffff80eff2cb40 x7: ffffff80eff2cb40 x6: ffffff8002bee480 x5: ffffffc080cb2220 x4: ffffffc080cb2150 x3: 00000000000f4240 x2: 0000000000000102 x1: ffffff80eff2bb00 x0 Rastreo de llamadas: __run_timers+0x244/0x268 timer_expire_remote+0x50/0x68 tmigr_handle_remote+0x388/0x39c run_timer_softirq+0x38/0x44 handle_softirqs+0x138/0x298 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x7c/0x80 llamada_inactiva_predeterminada+0x34/0x68 do_idle+0x23c/0x294 entrada_inicio_cpu+0x38/0x3c n\u00facleo_inicio_secundario+0x128/0x160 __conmutaci\u00f3n_secundaria+0xb8/0xbc ---[ fin de seguimiento 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/i2c/tc358743.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"13193a97ddd5a6a5b11408ddbc1ae85588b1860c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"815d14147068347e88c258233eb951b41b2792a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"34a3466a92f50c51d984f0ec2e96864886d460eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"b59ab89bc83f7bff67f78c6caf484a84a6dd30f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"1def915b1564f4375330bd113ea1d768a569cfd8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e66a52a2e4c832dfa35a39204d0f7ce717d4a4a\",\"lessThan\":\"869f38ae07f7df829da4951c3d1f7a2be09c2e9a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/i2c/tc358743.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.4\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"5.4.287\",\"matchCriteriaId\":\"B3FC0E85-A276-4943-A145-65EB84DFBC0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.4\",\"matchCriteriaId\":\"04756810-D093-4B43-B1D9-CF5035968061\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13193a97ddd5a6a5b11408ddbc1ae85588b1860c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1def915b1564f4375330bd113ea1d768a569cfd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/34a3466a92f50c51d984f0ec2e96864886d460eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/815d14147068347e88c258233eb951b41b2792a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/869f38ae07f7df829da4951c3d1f7a2be09c2e9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b59ab89bc83f7bff67f78c6caf484a84a6dd30f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2025-11-25T08:50:07+00:00",
      "cve": "CVE-2024-56576",
      "id": "CVE-2024-56576",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: i2c: tc358743: Fix crash in the probe error path when using polling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56576.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:19:12Z",
      "cve": "CVE-2024-56576",
      "id": "CVE-2024-56576",
      "initial_release_date": "2025-02-14T04:00:54Z",
      "product_status:known_affected": "644",
      "product_status:known_not_affected": "127",
      "product_status:recommended": "363",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56576",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56576.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.