CVE-2024-58002: media: uvcvideo: Remove dangling pointers

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel4.19 and later · before 6.6.80
• linux linux kernel6.7 and later · before 6.12.14
• linux linux kernel6.13 and later · before 6.13.3

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 4.19affected
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 2a29413ace64627e178fd422dd8a5d95219a2c0baffected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 653993f46861f2971e95e9a0e36a34b49dec542caffected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50affected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before ac18d781466252cd35a3e311e0a4b264260fd927affected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 4dbaa738c583a0e947803c69e8996e88cf98d971affected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 438bda062b2c40ddd7df23b932e29ffe0a448cacaffected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 9edc7d25f7e49c33a1ce7a5ffadea2222065516caffected · git
  • e5225c820c057537dc780244760e2e24c7d27366 and later · before 221cd51efe4565501a3dbf04cc011b537dcce7fbaffected · git
  • before 4.19not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-52560Feb 27, 2025 · fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
  22Monitor
• ← EarlierCVE-2024-54458Feb 27, 2025 · scsi: ufs: bsg: Set bsg_queue to NULL after removal
  31Monitor
• Later →CVE-2024-58005Feb 27, 2025 · tpm: Change to kvalloc() in eventlog/acpi.c
  22Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.