CVE-2024-58004 (GCVE-0-2024-58004)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-08-05 11:47
VLAI
Title
media: intel/ipu6: remove cpu latency qos request on error
Summary
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: remove cpu latency qos request on error Fix cpu latency qos list corruption like below. It happens when we do not remove cpu latency request on error path and free corresponding memory. [ 30.634378] l7 kernel: list_add corruption. prev->next should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8). [ 30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0 <snip> [ 30.634640] l7 kernel: Call Trace: [ 30.634650] l7 kernel: <TASK> [ 30.634659] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634669] l7 kernel: ? __warn.cold+0x93/0xf6 [ 30.634678] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634690] l7 kernel: ? report_bug+0xff/0x140 [ 30.634702] l7 kernel: ? handle_bug+0x58/0x90 [ 30.634712] l7 kernel: ? exc_invalid_op+0x17/0x70 [ 30.634723] l7 kernel: ? asm_exc_invalid_op+0x1a/0x20 [ 30.634733] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634742] l7 kernel: plist_add+0xdd/0x140 [ 30.634754] l7 kernel: pm_qos_update_target+0xa0/0x1f0 [ 30.634764] l7 kernel: cpu_latency_qos_update_request+0x61/0xc0 [ 30.634773] l7 kernel: intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f50c4ca0a82003b8a542c3332fd292cf1bc355a2 , < 1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d (git)
Affected: f50c4ca0a82003b8a542c3332fd292cf1bc355a2 , < 95275736185ecb71dc97a71d8d9d19e4ffb0a9eb (git)
Affected: f50c4ca0a82003b8a542c3332fd292cf1bc355a2 , < facb541ff0805314e0b56e508f7d3cbd07af513c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.14 , ≤ 6.12.* (semver)
Unaffected: 6.13.3 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/intel/ipu6/ipu6-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d",
              "status": "affected",
              "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2",
              "versionType": "git"
            },
            {
              "lessThan": "95275736185ecb71dc97a71d8d9d19e4ffb0a9eb",
              "status": "affected",
              "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2",
              "versionType": "git"
            },
            {
              "lessThan": "facb541ff0805314e0b56e508f7d3cbd07af513c",
              "status": "affected",
              "version": "f50c4ca0a82003b8a542c3332fd292cf1bc355a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/intel/ipu6/ipu6-isys.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: intel/ipu6: remove cpu latency qos request on error\n\nFix cpu latency qos list corruption like below. It happens when\nwe do not remove cpu latency request on error path and free\ncorresponding memory.\n\n[   30.634378] l7 kernel: list_add corruption. prev-\u003enext should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8).\n[   30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0\n\u003csnip\u003e\n[   30.634640] l7 kernel: Call Trace:\n[   30.634650] l7 kernel:  \u003cTASK\u003e\n[   30.634659] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\n[   30.634669] l7 kernel:  ? __warn.cold+0x93/0xf6\n[   30.634678] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\n[   30.634690] l7 kernel:  ? report_bug+0xff/0x140\n[   30.634702] l7 kernel:  ? handle_bug+0x58/0x90\n[   30.634712] l7 kernel:  ? exc_invalid_op+0x17/0x70\n[   30.634723] l7 kernel:  ? asm_exc_invalid_op+0x1a/0x20\n[   30.634733] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\n[   30.634742] l7 kernel:  plist_add+0xdd/0x140\n[   30.634754] l7 kernel:  pm_qos_update_target+0xa0/0x1f0\n[   30.634764] l7 kernel:  cpu_latency_qos_update_request+0x61/0xc0\n[   30.634773] l7 kernel:  intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a PCI/auxiliary-bus camera driver probe path, and the resulting corrupted global PM-QoS list is exercised through local interfaces (ALSA PCM ioctls, DRM ioctls, cpuidle). There is no network-reachable path to either the corruption or its exploitation.\nAC:L - On an affected system the dangling plist node is established deterministically during boot whenever isys_probe() fails (the reported real-world case on Intel IPU6 laptops), and from there the attacker\u0027s steps \u2014 heap-spraying the freed devres allocation and issuing SNDRV_PCM_IOCTL_HW_PARAMS to force plist_add() \u2014 are fully repeatable with no race to win and no memory layout the attacker cannot influence.\nPR:L - A plain unprivileged local user account suffices: /dev/snd PCM hw_params reaches cpu_latency_qos_add_request() directly, and heap spraying of the freed kmalloc object needs no capabilities. No root, CAP_SYS_ADMIN, or namespace privileges are required.\nUI:N - The corrupted global PM-QoS list already exists after boot on the affected configuration, and the attacker triggers traversal of it entirely on their own via ordinary ioctls. No victim action is needed.\nS:U - The use-after-free and any resulting privilege escalation are confined to the kernel of the same machine, managed by a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a globally reachable list node; plist_add()/plist_del() dereference attacker-controlled pointers read out of the reclaimed object, yielding arbitrary kernel memory reads and disclosure of freed-object/kernel-pointer contents.\nI:H - With the freed object reclaimed by attacker-controlled data, plist_add()\u0027s list_add_tail() writes list pointers into attacker-chosen kernel addresses (CONFIG_DEBUG_LIST is off on production kernels), giving a write-what-where primitive suitable for control-flow hijack and privilege escalation.\nA:H - The corrupted plist is walked under the pm_qos_lock raw spinlock by many subsystems, so it reliably produces list-corruption WARNINGs, oopses, or an unrecoverable hard lockup \u2014 the reporter observed exactly this crash path from i915\u0027s DP AUX transfer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:22.343Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d"
        },
        {
          "url": "https://git.kernel.org/stable/c/95275736185ecb71dc97a71d8d9d19e4ffb0a9eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/facb541ff0805314e0b56e508f7d3cbd07af513c"
        }
      ],
      "title": "media: intel/ipu6: remove cpu latency qos request on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58004",
    "datePublished": "2025-02-27T02:12:01.426Z",
    "dateReserved": "2025-02-27T02:10:48.226Z",
    "dateUpdated": "2026-08-05T11:47:22.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58004",
      "date": "2026-08-20",
      "epss": "0.00198",
      "percentile": "0.09974"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58004\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:11.380\",\"lastModified\":\"2026-08-04T11:22:36.353\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: intel/ipu6: remove cpu latency qos request on error\\n\\nFix cpu latency qos list corruption like below. It happens when\\nwe do not remove cpu latency request on error path and free\\ncorresponding memory.\\n\\n[   30.634378] l7 kernel: list_add corruption. prev-\u003enext should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8).\\n[   30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0\\n\u003csnip\u003e\\n[   30.634640] l7 kernel: Call Trace:\\n[   30.634650] l7 kernel:  \u003cTASK\u003e\\n[   30.634659] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\\n[   30.634669] l7 kernel:  ? __warn.cold+0x93/0xf6\\n[   30.634678] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\\n[   30.634690] l7 kernel:  ? report_bug+0xff/0x140\\n[   30.634702] l7 kernel:  ? handle_bug+0x58/0x90\\n[   30.634712] l7 kernel:  ? exc_invalid_op+0x17/0x70\\n[   30.634723] l7 kernel:  ? asm_exc_invalid_op+0x1a/0x20\\n[   30.634733] l7 kernel:  ? __list_add_valid_or_report+0x83/0xa0\\n[   30.634742] l7 kernel:  plist_add+0xdd/0x140\\n[   30.634754] l7 kernel:  pm_qos_update_target+0xa0/0x1f0\\n[   30.634764] l7 kernel:  cpu_latency_qos_update_request+0x61/0xc0\\n[   30.634773] l7 kernel:  intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: intel/ipu6: eliminar solicitud de QoS de latencia de CPU en caso de error Corrija la corrupci\u00f3n de la lista de QoS de latencia de CPU como se muestra a continuaci\u00f3n. Ocurre cuando no eliminamos la solicitud de latencia de CPU en la ruta de error y liberamos la memoria correspondiente. [ 30.634378] l7 kernel: list_add corruption. prev-\u0026gt;next should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8). [ 30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0  [ 30.634640] l7 kernel: Call Trace: [ 30.634650] l7 kernel:  [ 30.634659] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634669] l7 kernel: ? __warn.cold+0x93/0xf6 [ 30.634678] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634690] l7 kernel: ? report_bug+0xff/0x140 [ 30.634702] l7 kernel: ? handle_bug+0x58/0x90 [ 30.634712] l7 kernel: ? exc_invalid_op+0x17/0x70 [ 30.634723] l7 kernel: ? asm_exc_invalid_op+0x1a/0x20 [ 30.634733] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0 [ 30.634742] l7 kernel: plist_add+0xdd/0x140 [ 30.634754] l7 kernel: pm_qos_update_target+0xa0/0x1f0 [ 30.634764] l7 kernel: cpu_latency_qos_update_request+0x61/0xc0 [ 30.634773] l7 kernel: intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033] \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/pci/intel/ipu6/ipu6-isys.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f50c4ca0a82003b8a542c3332fd292cf1bc355a2\",\"lessThan\":\"1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f50c4ca0a82003b8a542c3332fd292cf1bc355a2\",\"lessThan\":\"95275736185ecb71dc97a71d8d9d19e4ffb0a9eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f50c4ca0a82003b8a542c3332fd292cf1bc355a2\",\"lessThan\":\"facb541ff0805314e0b56e508f7d3cbd07af513c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/pci/intel/ipu6/ipu6-isys.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.14\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.3\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.14\",\"matchCriteriaId\":\"39B6CD9F-15B4-4B45-976A-23B03B501740\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.3\",\"matchCriteriaId\":\"0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1496ec94bd38bdb25ca13b1dd4f8e7a6176ea89d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95275736185ecb71dc97a71d8d9d19e4ffb0a9eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/facb541ff0805314e0b56e508f7d3cbd07af513c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:03:38+00:00",
      "cve": "CVE-2024-58004",
      "id": "CVE-2024-58004",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: intel/ipu6: remove cpu latency qos request on error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58004.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:48:09Z",
      "cve": "CVE-2024-58004",
      "id": "CVE-2024-58004",
      "initial_release_date": "2025-02-28T02:23:08Z",
      "product_status:known_affected": "451",
      "product_status:known_not_affected": "295",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-58004",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-58004.json",
      "version": "30"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.