Use-After-Free Vulnerability in Linux Kernel i3c Driver by Vendor Linux

CVE-2024-57984

Summary

A use-after-free vulnerability was identified in the i3c driver of the Linux kernel. The flaw exists due to a race condition between the dw_i3c_common_probe and dw_i3c_common_remove functions. Specifically, if the dw_i3c_master driver module is removed while a specific work item is still in execution, the device could be unregistered and its associated resources freed, leading to potential system instability or exploitation. The issue has been addressed by ensuring that any ongoing work is properly canceled before executing cleanup processes.

References