CVE-2024-27043

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: edia: dvbdev: fix a use-after-free<br /> <br /> In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed<br /> in several error-handling paths. However, *pdvbdev is not set to NULL<br /> after dvbdev&amp;#39;s deallocation, causing use-after-frees in many places,<br /> for example, in the following call chain:<br /> <br /> budget_register<br /> |-&gt; dvb_dmxdev_init<br /> |-&gt; dvb_register_device<br /> |-&gt; dvb_dmxdev_release<br /> |-&gt; dvb_unregister_device<br /> |-&gt; dvb_remove_device<br /> |-&gt; dvb_device_put<br /> |-&gt; kref_put<br /> <br /> When calling dvb_unregister_device, dmxdev-&gt;dvbdev (i.e. *pdvbdev in<br /> dvb_register_device) could point to memory that had been freed in<br /> dvb_register_device. Thereafter, this pointer is transferred to<br /> kref_put and triggering a use-after-free.