LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26653: usb: misc: ljca: Fix double free in error handling path

In the Linux kernel, the following vulnerability has been resolved: usb: misc: ljca: Fix double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function ljca_auxdev_release calls kfree(auxdev->dev.platform_data) to free the parameter data of the function ljca_new_client_device. The callers of ljca_new_client_device shouldn't call kfree() again in the error handling path to free the platform data. Fix this by cleaning up the redundant kfree() in all callers and adding kfree() the passed in platform_data on errors which happen before auxiliary_device_init() succeeds .

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-26653 is a Linux kernel bug in the LJCA USB miscellaneous driver. Under a specific device-setup error path, memory can be freed twice. The public bundle does not provide CVSS, impact details, or evidence of active exploitation, so urgency depends on whether affected kernels and this driver are present.

Executive priority

Treat this as a kernel maintenance item unless asset inventory shows broad affected-kernel deployment. There is no provided evidence of active exploitation, but kernel memory safety bugs should be patched through normal security update channels.

Technical view

The issue is a double free in ljca_new_client_device error handling. If auxiliary_device_add() fails, auxiliary_device_uninit() triggers ljca_auxdev_release(), which frees auxdev->dev.platform_data. Callers then incorrectly freed that same platform data again. The fix removes redundant kfree() calls and handles earlier initialization failures separately.

Likely exposure

Relevant exposure is Linux systems running the affected kernel versions identified in the bundle, especially 6.7/6.8-era kernels with the usb misc ljca code present. The sources do not state distribution package status, device prerequisites, or remote reachability.

Exploitation context

The CVE is not listed as CISA KEV in the provided bundle, and no cited source reports exploitation. The available description indicates an error-path memory management flaw, but does not establish exploitability, required privileges, or practical attack conditions.

Researcher notes

The source evidence is limited to the CVE description and three kernel stable commits. Key missing items are CVSS, CWE mapping, distribution advisories, reachability conditions, and exploitation evidence. Avoid assuming remote exposure or a working exploit from the current record.

Mitigation direction

  • Check your Linux vendor advisory for CVE-2024-26653 and kernel backports.
  • Prioritize kernel updates where affected versions are deployed on relevant systems.
  • Track the referenced stable kernel commits for the exact upstream fix lineage.
  • If updates are unavailable, ask the vendor for supported mitigation guidance.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, and embedded deployments.
  • Identify systems running affected 6.7/6.8-era kernels listed in the bundle.
  • Confirm whether vendor kernels include one of the referenced stable fixes.
  • Document any systems where LJCA USB driver exposure is plausible.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26653 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxacd6199f195d6de814ac4090ce0864a613b1580e, acd6199f195d6de814ac4090ce0864a613b1580e, acd6199f195d6de814ac4090ce0864a613b1580eunaffected
LinuxLinux6.7, 0, 6.7.12, 6.8.3, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.