{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-26749",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2024-26749"
  ],
  "published": "2024-04-03T17:31:22Z",
  "summary": "usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()\n\n  ...\n  cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);\n  list_del_init(&priv_req->list);\n  ...\n\n'priv_req' actually free at cdns3_gadget_ep_free_request(). But\nlist_del_init() use priv_req->list after it.\n\n[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4\n[ 1542.642868][  T534]\n[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):\n[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4\n[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]\n[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4\n[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8\n[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368\n[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28\n\nMove list_del_init() before cdns3_gadget_ep_free_request() to resolve this\nproblem.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.80",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26749"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cfa9abb5570c489dabf6f7fb3a066cc576fc8824"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b40328eea93c75a5645891408010141a0159f643"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4e5c73b15d95452c1ba9c771dd013a3fbe052ff3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2134e9906e17b1e5284300fab547869ebacfd7d9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/29e42e1578a10c611b3f1a38f3229b2d664b5d16"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9a07244f614bc417de527b799da779dcae780b5d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cd45f99034b0c8c9cb346dd0d6407a95ca3d36f6"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-05-12T04:54:46Z"
  }
}