CVE-2024-46746 (GCVE-0-2024-46746)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-08-05 11:38
VLAI
Title
HID: amd_sfh: free driver_data after destroying hid device
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.2196 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4f567b9f8141a86c7d878fadf136e5d1408e3e61 , < 86b4f5cf91ca03c08e3822ac89476a677a780bcc (git)
Affected: 4f567b9f8141a86c7d878fadf136e5d1408e3e61 , < 775125c7fe38533aaa4b20769f5b5e62cc1170a0 (git)
Affected: 4f567b9f8141a86c7d878fadf136e5d1408e3e61 , < 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 (git)
Affected: 4f567b9f8141a86c7d878fadf136e5d1408e3e61 , < adb3e3c1ddb5a23b8b7122ef1913f528d728937c (git)
Affected: 4f567b9f8141a86c7d878fadf136e5d1408e3e61 , < 97155021ae17b86985121b33cf8098bcde00d497 (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.110 , ≤ 6.1.* (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:48:56.187128Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:49:10.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:17:39.964Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/amd-sfh-hid/amd_sfh_hid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86b4f5cf91ca03c08e3822ac89476a677a780bcc",
              "status": "affected",
              "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61",
              "versionType": "git"
            },
            {
              "lessThan": "775125c7fe38533aaa4b20769f5b5e62cc1170a0",
              "status": "affected",
              "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61",
              "versionType": "git"
            },
            {
              "lessThan": "60dc4ee0428d70bcbb41436b6729d29f1cbdfb89",
              "status": "affected",
              "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61",
              "versionType": "git"
            },
            {
              "lessThan": "adb3e3c1ddb5a23b8b7122ef1913f528d728937c",
              "status": "affected",
              "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61",
              "versionType": "git"
            },
            {
              "lessThan": "97155021ae17b86985121b33cf8098bcde00d497",
              "status": "affected",
              "version": "4f567b9f8141a86c7d878fadf136e5d1408e3e61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/amd-sfh-hid/amd_sfh_hid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: free driver_data after destroying hid device\n\nHID driver callbacks aren\u0027t called anymore once hid_destroy_device() has\nbeen called. Hence, hid driver_data should be freed only after the\nhid_destroy_device() function returned as driver_data is used in several\ncallbacks.\n\nI observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling\nKASAN to debug memory allocation, I got this output:\n\n  [   13.050438] ==================================================================\n  [   13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]\n  [   13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3\n  [   13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479\n\n  [   13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0\n  [   13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024\n  [   13.067860] Call Trace:\n  [   13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8\n  [   13.071486]  \u003cTASK\u003e\n  [   13.071492]  dump_stack_lvl+0x5d/0x80\n  [   13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -\u003e 0002)\n  [   13.078296]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.082199]  print_report+0x174/0x505\n  [   13.085776]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [   13.089367]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.093255]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.097464]  kasan_report+0xc8/0x150\n  [   13.101461]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.105802]  amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.110303]  amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.114879]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.119450]  sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]\n  [   13.124097]  hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\n  [   13.127404]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.131925]  ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\n  [   13.136455]  ? _raw_spin_lock_irqsave+0x96/0xf0\n  [   13.140197]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [   13.143602]  ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]\n  [   13.147234]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.150446]  ? __devm_add_action+0x167/0x1d0\n  [   13.155061]  hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\n  [   13.158581]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.161814]  platform_probe+0xa2/0x150\n  [   13.165029]  really_probe+0x1e3/0x8a0\n  [   13.168243]  __driver_probe_device+0x18c/0x370\n  [   13.171500]  driver_probe_device+0x4a/0x120\n  [   13.175000]  __driver_attach+0x190/0x4a0\n  [   13.178521]  ? __pfx___driver_attach+0x10/0x10\n  [   13.181771]  bus_for_each_dev+0x106/0x180\n  [   13.185033]  ? __pfx__raw_spin_lock+0x10/0x10\n  [   13.188229]  ? __pfx_bus_for_each_dev+0x10/0x10\n  [   13.191446]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.194382]  bus_add_driver+0x29e/0x4d0\n  [   13.197328]  driver_register+0x1a5/0x360\n  [   13.200283]  ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\n  [   13.203362]  do_one_initcall+0xa7/0x380\n  [   13.206432]  ? __pfx_do_one_initcall+0x10/0x10\n  [   13.210175]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.213211]  ? kasan_unpoison+0x44/0x70\n  [   13.216688]  do_init_module+0x238/0x750\n  [   13.2196\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both halves are local \u2014 the free comes from amd_sfh driver teardown (probe-failure `cleanup:` path or PCI unbind/module unload) and the use comes from `hid_hw_request()` driven through IIO sysfs on the local machine. No network or adjacent-network input reaches `amd_sfh_get_report()`.\nAC:L - An unprivileged process can keep HID callbacks continuously in flight by looping reads of the world-readable `in_*_raw` IIO attributes, and `amdtp_wait_for_response()`\u0027s 1500 ms wait plus `_hid_sensor_power_state()`\u0027s `msleep_interruptible()` leave a multi-millisecond window that is retried at will; reclaiming a 64-byte kmalloc slot from userspace is a standard, reliable spray.\nPR:L - The entire use side \u2014 `hid_hw_request()`/`hid_hw_wait()` into `amd_sfh_get_report()`/`amd_sfh_set_report()` \u2014 is reachable by any local user through 0444 IIO sysfs attributes, and the free side is hit by the probe-time `amd_sfh_hid_client_init()` cleanup path that runs on its own without any privileged action, so no root or real capability is needed by the attacker.\nUI:N - The attacker drives the HID callbacks and the heap grooming itself; the freeing teardown occurs from driver lifecycle events (probe cleanup, unbind) rather than from any action a victim user must be tricked into performing.\nS:U - The freed `struct amdtp_hid_data` and the objects reached through the stale `cli_data` pointer all belong to the kernel itself, so impact stays inside the kernel\u0027s own security authority with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `hid-\u003edriver_data` is dereferenced after `kfree()`, so a resprayed kmalloc-64 slot supplies an attacker-chosen `cli_data`, and the subsequent reads of `cli_data-\u003enum_hid_devices`, `-\u003esensor_idx[i]`, `-\u003ein_data` and `-\u003ehid_sensor_hubs[i]` (fed back to userspace via `hid_input_report()` into IIO values) amount to arbitrary kernel memory disclosure.\nI:H - The same controlled `cli_data` yields writes at attacker-chosen addresses \u2014 `cli_data-\u003ereport_id[i] = report_id`, `-\u003erequest_done[i] = false`, `-\u003ecur_hid_dev = i`, and `list_add(\u0026new-\u003elist, \u0026req_list-\u003elist)` \u2014 while `schedule_delayed_work(\u0026cli_data-\u003ework, 0)` and `wake_up_interruptible(\u0026hid_data-\u003ehid_wait)` operate on freed/forged structures, giving a control-flow hijack primitive.\nA:H - The reported KASAN slab-use-after-free in `amd_sfh_get_report()` is immediately followed by a fatal `Oops: general protection fault, probably for non-canonical address`, so the bug reliably panics the kernel even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:19.210Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86b4f5cf91ca03c08e3822ac89476a677a780bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/775125c7fe38533aaa4b20769f5b5e62cc1170a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/60dc4ee0428d70bcbb41436b6729d29f1cbdfb89"
        },
        {
          "url": "https://git.kernel.org/stable/c/adb3e3c1ddb5a23b8b7122ef1913f528d728937c"
        },
        {
          "url": "https://git.kernel.org/stable/c/97155021ae17b86985121b33cf8098bcde00d497"
        }
      ],
      "title": "HID: amd_sfh: free driver_data after destroying hid device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46746",
    "datePublished": "2024-09-18T07:12:06.910Z",
    "dateReserved": "2024-09-11T15:12:18.266Z",
    "dateUpdated": "2026-08-05T11:38:19.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46746",
      "date": "2026-08-06",
      "epss": "0.00248",
      "percentile": "0.16163"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:39:40.000Z",
      "cve": "CVE-2024-46746",
      "id": "msrc_CVE-2024-46746",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HID: amd_sfh: free driver_data after destroying hid device",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46746.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46746\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:03.730\",\"lastModified\":\"2026-06-17T07:55:51.017\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: amd_sfh: free driver_data after destroying hid device\\n\\nHID driver callbacks aren\u0027t called anymore once hid_destroy_device() has\\nbeen called. Hence, hid driver_data should be freed only after the\\nhid_destroy_device() function returned as driver_data is used in several\\ncallbacks.\\n\\nI observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling\\nKASAN to debug memory allocation, I got this output:\\n\\n  [   13.050438] ==================================================================\\n  [   13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]\\n  [   13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3\\n  [   13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479\\n\\n  [   13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0\\n  [   13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024\\n  [   13.067860] Call Trace:\\n  [   13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8\\n  [   13.071486]  \u003cTASK\u003e\\n  [   13.071492]  dump_stack_lvl+0x5d/0x80\\n  [   13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -\u003e 0002)\\n  [   13.078296]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.082199]  print_report+0x174/0x505\\n  [   13.085776]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  [   13.089367]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.093255]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.097464]  kasan_report+0xc8/0x150\\n  [   13.101461]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.105802]  amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.110303]  amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.114879]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.119450]  sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]\\n  [   13.124097]  hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\\n  [   13.127404]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.131925]  ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\\n  [   13.136455]  ? _raw_spin_lock_irqsave+0x96/0xf0\\n  [   13.140197]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  [   13.143602]  ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]\\n  [   13.147234]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.150446]  ? __devm_add_action+0x167/0x1d0\\n  [   13.155061]  hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\\n  [   13.158581]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.161814]  platform_probe+0xa2/0x150\\n  [   13.165029]  really_probe+0x1e3/0x8a0\\n  [   13.168243]  __driver_probe_device+0x18c/0x370\\n  [   13.171500]  driver_probe_device+0x4a/0x120\\n  [   13.175000]  __driver_attach+0x190/0x4a0\\n  [   13.178521]  ? __pfx___driver_attach+0x10/0x10\\n  [   13.181771]  bus_for_each_dev+0x106/0x180\\n  [   13.185033]  ? __pfx__raw_spin_lock+0x10/0x10\\n  [   13.188229]  ? __pfx_bus_for_each_dev+0x10/0x10\\n  [   13.191446]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.194382]  bus_add_driver+0x29e/0x4d0\\n  [   13.197328]  driver_register+0x1a5/0x360\\n  [   13.200283]  ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\\n  [   13.203362]  do_one_initcall+0xa7/0x380\\n  [   13.206432]  ? __pfx_do_one_initcall+0x10/0x10\\n  [   13.210175]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.213211]  ? kasan_unpoison+0x44/0x70\\n  [   13.216688]  do_init_module+0x238/0x750\\n  [   13.2196\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: amd_sfh: liberar driver_data despu\u00e9s de destruir el dispositivo HID Las devoluciones de llamadas del controlador HID ya no se invocan una vez que se ha invocado hid_destroy_device(). Por lo tanto, hid driver_data deber\u00eda liberarse solo despu\u00e9s de que la funci\u00f3n hid_destroy_device() devuelta como driver_data se use en varias devoluciones de llamadas. Observ\u00e9 un fallo con el kernel 6.10.0 en mi T14s Gen 3, despu\u00e9s de habilitar KASAN para depurar la asignaci\u00f3n de memoria, obtuve este resultado: [ 13.050438] ======================================================================= [ 13.054060] ERROR: KASAN: slab-use-after-free en amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: firmware Synaptics TrackPoint: 0x02, botones: 3/3 [ 13.056432] Lectura de tama\u00f1o 8 en addr ffff88813152f408 por tarea (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) No contaminado 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Nombre del hardware: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 21/03/2024 [ 13.067860] Seguimiento de llamadas: [ 13.069383] entrada: TPPS/2 Synaptics TrackPoint como /devices/platform/i8042/serio1/input/input8 [ [13.071486]  [13.071492] dump_stack_lvl+0x5d/0x80 [13.074870] snd_hda_intel 0000:33:00.6: habilitando dispositivo (0000 -\u0026gt; 0002) [13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [13.082199] print_report+0x174/0x505 [13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? es: amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [13.143602] ? __devm_add_action+0x167/0x1d0 [13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [13.158581] ? __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_para_cada_dispositivo+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_para_cada_dispositivo+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] hacer_una_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.2196 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hid/amd-sfh-hid/amd_sfh_hid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4f567b9f8141a86c7d878fadf136e5d1408e3e61\",\"lessThan\":\"86b4f5cf91ca03c08e3822ac89476a677a780bcc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f567b9f8141a86c7d878fadf136e5d1408e3e61\",\"lessThan\":\"775125c7fe38533aaa4b20769f5b5e62cc1170a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f567b9f8141a86c7d878fadf136e5d1408e3e61\",\"lessThan\":\"60dc4ee0428d70bcbb41436b6729d29f1cbdfb89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f567b9f8141a86c7d878fadf136e5d1408e3e61\",\"lessThan\":\"adb3e3c1ddb5a23b8b7122ef1913f528d728937c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f567b9f8141a86c7d878fadf136e5d1408e3e61\",\"lessThan\":\"97155021ae17b86985121b33cf8098bcde00d497\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hid/amd-sfh-hid/amd_sfh_hid.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.167\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.110\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:48:56.187128Z\",\"id\":\"CVE-2024-46746\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.167\",\"matchCriteriaId\":\"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.110\",\"matchCriteriaId\":\"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/60dc4ee0428d70bcbb41436b6729d29f1cbdfb89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/775125c7fe38533aaa4b20769f5b5e62cc1170a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86b4f5cf91ca03c08e3822ac89476a677a780bcc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97155021ae17b86985121b33cf8098bcde00d497\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/adb3e3c1ddb5a23b8b7122ef1913f528d728937c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:02:32+00:00",
      "cve": "CVE-2024-46746",
      "id": "CVE-2024-46746",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: amd_sfh: free driver_data after destroying hid device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46746.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46746\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:48:56.187128Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:49:00.658Z\"}}], \"cna\": {\"title\": \"HID: amd_sfh: free driver_data after destroying hid device\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4f567b9f8141a86c7d878fadf136e5d1408e3e61\", \"lessThan\": \"86b4f5cf91ca03c08e3822ac89476a677a780bcc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f567b9f8141a86c7d878fadf136e5d1408e3e61\", \"lessThan\": \"775125c7fe38533aaa4b20769f5b5e62cc1170a0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f567b9f8141a86c7d878fadf136e5d1408e3e61\", \"lessThan\": \"60dc4ee0428d70bcbb41436b6729d29f1cbdfb89\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f567b9f8141a86c7d878fadf136e5d1408e3e61\", \"lessThan\": \"adb3e3c1ddb5a23b8b7122ef1913f528d728937c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f567b9f8141a86c7d878fadf136e5d1408e3e61\", \"lessThan\": \"97155021ae17b86985121b33cf8098bcde00d497\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/hid/amd-sfh-hid/amd_sfh_hid.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/hid/amd-sfh-hid/amd_sfh_hid.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/86b4f5cf91ca03c08e3822ac89476a677a780bcc\"}, {\"url\": \"https://git.kernel.org/stable/c/775125c7fe38533aaa4b20769f5b5e62cc1170a0\"}, {\"url\": \"https://git.kernel.org/stable/c/60dc4ee0428d70bcbb41436b6729d29f1cbdfb89\"}, {\"url\": \"https://git.kernel.org/stable/c/adb3e3c1ddb5a23b8b7122ef1913f528d728937c\"}, {\"url\": \"https://git.kernel.org/stable/c/97155021ae17b86985121b33cf8098bcde00d497\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: amd_sfh: free driver_data after destroying hid device\\n\\nHID driver callbacks aren\u0027t called anymore once hid_destroy_device() has\\nbeen called. Hence, hid driver_data should be freed only after the\\nhid_destroy_device() function returned as driver_data is used in several\\ncallbacks.\\n\\nI observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling\\nKASAN to debug memory allocation, I got this output:\\n\\n  [   13.050438] ==================================================================\\n  [   13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]\\n  [   13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3\\n  [   13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479\\n\\n  [   13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0\\n  [   13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024\\n  [   13.067860] Call Trace:\\n  [   13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8\\n  [   13.071486]  \u003cTASK\u003e\\n  [   13.071492]  dump_stack_lvl+0x5d/0x80\\n  [   13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -\u003e 0002)\\n  [   13.078296]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.082199]  print_report+0x174/0x505\\n  [   13.085776]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  [   13.089367]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.093255]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.097464]  kasan_report+0xc8/0x150\\n  [   13.101461]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.105802]  amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.110303]  amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\\n  [   13.114879]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.119450]  sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]\\n  [   13.124097]  hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\\n  [   13.127404]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.131925]  ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\\n  [   13.136455]  ? _raw_spin_lock_irqsave+0x96/0xf0\\n  [   13.140197]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  [   13.143602]  ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]\\n  [   13.147234]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.150446]  ? __devm_add_action+0x167/0x1d0\\n  [   13.155061]  hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\\n  [   13.158581]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.161814]  platform_probe+0xa2/0x150\\n  [   13.165029]  really_probe+0x1e3/0x8a0\\n  [   13.168243]  __driver_probe_device+0x18c/0x370\\n  [   13.171500]  driver_probe_device+0x4a/0x120\\n  [   13.175000]  __driver_attach+0x190/0x4a0\\n  [   13.178521]  ? __pfx___driver_attach+0x10/0x10\\n  [   13.181771]  bus_for_each_dev+0x106/0x180\\n  [   13.185033]  ? __pfx__raw_spin_lock+0x10/0x10\\n  [   13.188229]  ? __pfx_bus_for_each_dev+0x10/0x10\\n  [   13.191446]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.194382]  bus_add_driver+0x29e/0x4d0\\n  [   13.197328]  driver_register+0x1a5/0x360\\n  [   13.200283]  ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\\n  [   13.203362]  do_one_initcall+0xa7/0x380\\n  [   13.206432]  ? __pfx_do_one_initcall+0x10/0x10\\n  [   13.210175]  ? srso_alias_return_thunk+0x5/0xfbef5\\n  [   13.213211]  ? kasan_unpoison+0x44/0x70\\n  [   13.216688]  do_init_module+0x238/0x750\\n  [   13.2196\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-01-17T15:56:15.598Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46746\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-17T15:56:15.598Z\", \"dateReserved\": \"2024-09-11T15:12:18.266Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:06.910Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.