CVE-2024-27043: media: edia: dvbdev: fix a use-after-free
Vulnerability summary
CVE-2024-27043 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 22% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 58 · Related 53Timeline
- 01-05-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dvb_register_device) could point to memory that had been freed in dvb_register_device. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu117 products
- linuxAll versions (No fix recorded) | < 5.4.0-189.209 | < 5.15.0-112.122 | < 6.8.0-35.35
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.4.0-1128.138 | < 5.15.0-1063.69 | < 6.8.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < d0f5c28333822f9baa5280d813124920720fd856 | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < f20c3270f3ed5aa6919a87e4de9bf6c05fb57086 | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < 096237039d00c839f3e3a5fe6d001bf0db45b644 | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < 0d3fe80b6d175c220b3e252efc6c6777e700e98e | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < 437a111f79a2f5b2a5f21e27fdec6f40c8768712 | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < 779e8db7efb22316c8581d6c229636d2f5694a62 | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < 35674111a043b0482a9bc69da8850a83f465b07d | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < b7586e902128e4fb7bfbb661cb52e4215a65637b | ≥ b61901024776b25ce7b8edc31bb1757c7382a88e, < 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 | 2.6.21
- linux_kernel≥ 2.6.21, < 4.19.311 | ≥ 4.20, < 5.4.273 | ≥ 5.5, < 5.10.214 | ≥ 5.11, < 5.15.153 | ≥ 5.16, < 6.1.83 | ≥ 6.2, < 6.6.23 | ≥ 6.7, < 6.7.11 | ≥ 6.8, < 6.8.2
Debian1 product
- linux< 6.1.85-1 | < 6.7.12-1
3 vendors · 120 products
