CVE-2024-53213

A double free vulnerability was found in the Linux kernel. In lan78xx_probe(), the buf buffer is freed twice: once implicitly through usb_free_urb(dev->urb_intr) with the URB_FREE_BUFFER flag and again explicitly by kfree(buf), resulting in loss of availability of the system.

This vulnerability is rated as having a Moderate impact because exploitation requires the physical attachment of a specialized USB device or control over virtualized USB passthrough, which limits exposure to local attackers with device-level access. Successful triggering of the memory corruption flaw during driver probing results in a kernel crash, leading to a local denial of service without compromising data confidentiality or integrity. Enterprise server environments typically do not utilize Microchip LAN78xx USB ethernet adapters, substantially reducing default operational exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.