CVE-2024-58003

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()

The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as part of their remove process, and if the driver is removed multiple times, eventually leads to put "overflow", possibly causing memory corruption or crash.

The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching"), which changed the code related to the sd.fwnode, but missed removing these fwnode_handle_put() calls.

This vulnerability does not affect supported Red Hat Enterprise Linux releases because the vulnerable code introduced in upstream Linux kernel 6.6 is not present in enterprise kernel builds. The issue is confined to drivers for specialized Texas Instruments FPD-Link serializer hardware that is not commonly deployed in enterprise server environments. Furthermore, triggering the condition requires local administrative privileges to unbind or unload the driver multiple times on a system with the physical device present.