CVE-2024-46674 (GCVE-0-2024-46674)

Vulnerability from cvelistv5 – Published: 2024-09-13 05:29 – Updated: 2026-08-05 11:37
VLAI
Title
usb: dwc3: st: fix probed platform device ref count on probe error path
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: st: fix probed platform device ref count on probe error path The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < b0979a885b9d4df2a25b88e9d444ccaa5f9f495c (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < f3498650df0805c75b4e1c94d07423c46cbf4ce1 (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < 6aee4c5635d81f4809c3b9f0c198a65adfbb2ada (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < 060f41243ad7f6f5249fa7290dda0c01f723d12d (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < 4c6735299540f3c82a5033d35be76a5c42e0fb18 (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49 (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < 1de989668708ce5875efc9d669d227212aeb9a90 (git)
Affected: f83fca0707c66e36f14efef7f68702cb12de70b7 , < ddfcfeba891064b88bb844208b43bef2ef970f0c (git)
Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 4.19.321 , ≤ 4.19.* (semver)
Unaffected: 5.4.283 , ≤ 5.4.* (semver)
Unaffected: 5.10.225 , ≤ 5.10.* (semver)
Unaffected: 5.15.166 , ≤ 5.15.* (semver)
Unaffected: 6.1.108 , ≤ 6.1.* (semver)
Unaffected: 6.6.49 , ≤ 6.6.* (semver)
Unaffected: 6.10.8 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:44:46.031544Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:45:00.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:08.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/dwc3-st.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0979a885b9d4df2a25b88e9d444ccaa5f9f495c",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "f3498650df0805c75b4e1c94d07423c46cbf4ce1",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "6aee4c5635d81f4809c3b9f0c198a65adfbb2ada",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "060f41243ad7f6f5249fa7290dda0c01f723d12d",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "4c6735299540f3c82a5033d35be76a5c42e0fb18",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "1de989668708ce5875efc9d669d227212aeb9a90",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            },
            {
              "lessThan": "ddfcfeba891064b88bb844208b43bef2ef970f0c",
              "status": "affected",
              "version": "f83fca0707c66e36f14efef7f68702cb12de70b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/dwc3-st.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.321",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.321",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.283",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.225",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.108",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.49",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: st: fix probed platform device ref count on probe error path\n\nThe probe function never performs any paltform device allocation, thus\nerror path \"undo_platform_dev_alloc\" is entirely bogus.  It drops the\nreference count from the platform device being probed.  If error path is\ntriggered, this will lead to unbalanced device reference counts and\npremature release of device resources, thus possible use-after-free when\nreleasing remaining devm-managed resources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in a platform-driver probe path reached through local kernel/driver-model operations \u2014 boot-time/deferred probe, module load, or sysfs bind/unbind \u2014 and the resulting dangling device is subsequently touched through local sysfs paths. No network or physical USB interaction is involved, so Local is the accurate vector.\nAC:L - The unbalanced put_device() executes unconditionally on every probe error path, including the routine -EPROBE_DEFER from devm_reset_control_get_exclusive(), and each deferred-probe retry repeats it deterministically. No race must be won and no unpredictable state is required.\nPR:L - No credential or capability check exists on the code path itself \u2014 the refcount underflow is executed by the kernel\u0027s own probe machinery. A basic unprivileged local user can then reach and dereference the prematurely freed struct device through world-readable sysfs entries and groom the slab to reclaim the freed platform_object.\nUI:N - The reference imbalance and premature free occur automatically during probe/deferred re-probe with no victim action required. Nobody has to mount, open, or plug in anything.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on a kmalloc\u0027d platform_object; after the slab is reclaimed, its contents are readable back through the device model and sysfs, enabling disclosure of arbitrary kernel heap data.\nI:H - The freed struct device is still dereferenced afterwards, including its dev-\u003erelease, dev-\u003ebus, dev-\u003etype, and kobj ktype function pointers, so reclaiming the freed slab yields a write/control-flow-hijack primitive rather than mere data damage.\nA:H - The refcount underflow frees the device while devres_release_all(), sysfs teardown, and the deferred-probe list still reference it, producing an oops or panic; repeated probe retries compound the corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:53.435Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49"
        },
        {
          "url": "https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c"
        }
      ],
      "title": "usb: dwc3: st: fix probed platform device ref count on probe error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46674",
    "datePublished": "2024-09-13T05:29:10.381Z",
    "dateReserved": "2024-09-11T15:12:18.247Z",
    "dateUpdated": "2026-08-05T11:37:53.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46674",
      "date": "2026-08-06",
      "epss": "0.00278",
      "percentile": "0.19947"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:37:06.000Z",
      "cve": "CVE-2024-46674",
      "id": "msrc_CVE-2024-46674",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: dwc3: st: fix probed platform device ref count on probe error path",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46674.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46674\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-13T06:15:12.017\",\"lastModified\":\"2026-06-17T07:55:42.313\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: dwc3: st: fix probed platform device ref count on probe error path\\n\\nThe probe function never performs any paltform device allocation, thus\\nerror path \\\"undo_platform_dev_alloc\\\" is entirely bogus.  It drops the\\nreference count from the platform device being probed.  If error path is\\ntriggered, this will lead to unbalanced device reference counts and\\npremature release of device resources, thus possible use-after-free when\\nreleasing remaining devm-managed resources.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: dwc3: st: fix probed platform device ref count on probe error path La funci\u00f3n de sonda nunca realiza ninguna asignaci\u00f3n de dispositivo de plataforma, por lo que la ruta de error \\\"undo_platform_dev_alloc\\\" es completamente falsa. Elimina el recuento de referencia del dispositivo de plataforma que se est\u00e1 sondeando. Si se activa la ruta de error, esto provocar\u00e1 recuentos de referencia de dispositivo desequilibrados y una liberaci\u00f3n prematura de los recursos del dispositivo, por lo que es posible que se produzca un use-after-free al liberar los recursos restantes administrados por devm.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/dwc3/dwc3-st.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"b0979a885b9d4df2a25b88e9d444ccaa5f9f495c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"f3498650df0805c75b4e1c94d07423c46cbf4ce1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"6aee4c5635d81f4809c3b9f0c198a65adfbb2ada\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"060f41243ad7f6f5249fa7290dda0c01f723d12d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"4c6735299540f3c82a5033d35be76a5c42e0fb18\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"1de989668708ce5875efc9d669d227212aeb9a90\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f83fca0707c66e36f14efef7f68702cb12de70b7\",\"lessThan\":\"ddfcfeba891064b88bb844208b43bef2ef970f0c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/dwc3/dwc3-st.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.321\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.283\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.225\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.166\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.108\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.49\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.8\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T15:44:46.031544Z\",\"id\":\"CVE-2024-46674\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"4.19.321\",\"matchCriteriaId\":\"070FA1B5-32A1-418F-8D79-F2A3F4C411C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.283\",\"matchCriteriaId\":\"8E6B390A-0CE6-44FC-8CD5-BE8226D6D24C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.225\",\"matchCriteriaId\":\"C57B46A9-B105-4792-8481-1870DEFB436A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.166\",\"matchCriteriaId\":\"913ED6CD-8ACF-48AF-AA18-7880881DD402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.108\",\"matchCriteriaId\":\"9B5BE381-F079-43D9-AEF2-931856B13219\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.49\",\"matchCriteriaId\":\"1191B7F1-F275-45F5-9E82-A012FF517BFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.8\",\"matchCriteriaId\":\"1B5D46C3-56A4-4380-9309-27BF73DF29A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:45:05+00:00",
      "cve": "CVE-2024-46674",
      "id": "CVE-2024-46674",
      "initial_release_date": "2024-09-13T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: dwc3: st: fix probed platform device ref count on probe error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46674.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:16:08.133Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46674\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:44:46.031544Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:44:50.342Z\"}}], \"cna\": {\"title\": \"usb: dwc3: st: fix probed platform device ref count on probe error path\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"b0979a885b9d4df2a25b88e9d444ccaa5f9f495c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"f3498650df0805c75b4e1c94d07423c46cbf4ce1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"6aee4c5635d81f4809c3b9f0c198a65adfbb2ada\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"060f41243ad7f6f5249fa7290dda0c01f723d12d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"4c6735299540f3c82a5033d35be76a5c42e0fb18\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"1de989668708ce5875efc9d669d227212aeb9a90\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f83fca0707c66e36f14efef7f68702cb12de70b7\", \"lessThan\": \"ddfcfeba891064b88bb844208b43bef2ef970f0c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/dwc3/dwc3-st.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.321\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.283\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.225\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.166\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.108\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.49\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/dwc3/dwc3-st.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c\"}, {\"url\": \"https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1\"}, {\"url\": \"https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada\"}, {\"url\": \"https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d\"}, {\"url\": \"https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18\"}, {\"url\": \"https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49\"}, {\"url\": \"https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90\"}, {\"url\": \"https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: dwc3: st: fix probed platform device ref count on probe error path\\n\\nThe probe function never performs any paltform device allocation, thus\\nerror path \\\"undo_platform_dev_alloc\\\" is entirely bogus.  It drops the\\nreference count from the platform device being probed.  If error path is\\ntriggered, this will lead to unbalanced device reference counts and\\npremature release of device resources, thus possible use-after-free when\\nreleasing remaining devm-managed resources.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.321\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.283\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.225\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.166\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.108\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.49\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.8\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:34:12.536Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46674\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:34:12.536Z\", \"dateReserved\": \"2024-09-11T15:12:18.247Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T05:29:10.381Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.