LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56766: mtd: rawnand: fix double free in atmel_pmecc_create_user()

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a double-free bug in the Atmel raw NAND PMECC code. It matters mainly for systems that use this specific NAND flash error-correction path. Public sources do not provide CVSS, confirmed impact, or evidence of active exploitation, so urgency depends on whether exposed assets run the affected kernel code.

Executive priority

Treat as targeted kernel maintenance, not an internet-wide emergency based on current evidence. Prioritize embedded or appliance fleets using raw NAND storage and schedule updates through normal kernel risk processes.

Technical view

The bug is in atmel_pmecc_create_user() under mtd rawnand. A pointer changed from kzalloc() allocation to devm_kzalloc(), but an error path still called kfree(user), creating a double free. Kernel stable commits and Debian LTS advisories are the named remediation sources.

Likely exposure

Likely exposure is limited to Linux systems using the Atmel raw NAND PMECC driver path, commonly relevant to specialized or embedded hardware. General-purpose Linux servers may not be affected unless this driver is present and reachable.

Exploitation context

The provided sources show no KEV listing, no public exploit claim, and no exploitation evidence. Triggerability, privilege requirements, and real-world impact are not specified in the bundle.

Researcher notes

Evidence is narrow: the root cause is clear, but CVSS, CWE, affected ranges, trigger conditions, and exploitability are not provided. Focus validation on code presence, kernel lineage, and downstream backport status rather than assuming broad Linux exposure.

Mitigation direction

  • Identify Linux systems using Atmel raw NAND PMECC support.
  • Update to vendor or distribution kernels containing the referenced stable fixes.
  • Review Debian LTS advisories if using Debian-packaged kernels.
  • Check vendor guidance for embedded appliances using custom kernels.

Validation and detection

  • Inventory kernel versions and downstream vendor build identifiers.
  • Check whether the Atmel raw NAND PMECC driver is enabled or loaded.
  • Compare deployed kernels against vendor fixed releases or referenced stable commits.
  • Confirm Debian systems include the relevant LTS security updates.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-56766 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux22fbbc37edb840fd420fadf670366be9bf028426, 54cb5fa850f9306d84e49a3db44b7a7eb5536cd1, 5fe7709251e334cc27618473299c48340cecd3c8, 24cbc37e837fd9e31e5024480b779207d1d99f1d, f1290871c8aaeb13029390a2b6e5c05733a1be6f, 8ac19ec818c548c5788da5926dcc8af96fad4bb1, 6d734f1bfc336aaea91313a5632f2f197608fadd, 2014fcea19ec27df033359a0f42db0e8ed4290a8, bdd11a04d102f8310812aa7cec39545fdd6662d1, 4.19.325, 6.11.11unaffected
LinuxLinux5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.12.2unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.