Oracle Linux: CVE-2024-36940: ELSA-2024-5101: kernel security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2024-36940: ELSA-2024-5101:kernel security update (IMPORTANT) (Multiple Advisories)

Severity

1

CVSS

(AV:L/AC:L/Au:M/C:N/I:N/A:P)

Published

05/30/2024

Created

08/20/2024

Added

08/16/2024

Modified

11/29/2024

Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

Solution(s)

• oracle-linux-upgrade-kernel

References

• https://attackerkb.com/topics/cve-2024-36940
• CVE - 2024-36940
• ELSA-2024-5101