LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57980: media: uvcvideo: Fix double free in error path

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Reviewed by: Ricardo Ribalda <ribalda@chromium.org>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-57980 is a Linux kernel bug in the USB video driver. A failed setup path can free the same memory twice, which can cause instability and may create memory-corruption risk. The public sources do not provide CVSS, CWE, exploit details, or evidence of active exploitation.

Executive priority

Treat as routine-to-priority kernel maintenance rather than an emergency based on current evidence. Patch during the next kernel update cycle, faster for fleets with webcams, kiosks, or unmanaged USB device exposure.

Technical view

The uvcvideo driver's uvc_status_init() frees dev->status when int_urb allocation fails, but previously left the pointer non-NULL. Later uvc_status_cleanup() could kfree() the same pointer again. Stable kernel commits fix this by setting dev->status to NULL after the first free.

Likely exposure

Exposure is limited to Linux systems running affected kernel builds with the uvcvideo driver present or used. Endpoints, kiosks, appliances, and systems with USB Video Class webcam support are the most plausible assets to review.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source claims active exploitation. The sources describe an error-path double free, but do not document practical exploitability, required privileges, or remote attack conditions.

Researcher notes

The affected data is kernel-centric and lacks CVSS, CWE, CPEs, and exploitation analysis. Validation should focus on vendor backports, because distribution package versions may contain the fix without matching upstream kernel version numbers.

Mitigation direction

  • Update Linux kernels to builds containing the referenced stable fixes.
  • Apply Debian LTS kernel updates where Debian LTS is in use.
  • Check vendor or distribution advisories for backported fixes.
  • Prioritize systems that expose or rely on USB video devices.

Validation and detection

  • Inventory Linux kernel versions across managed systems.
  • Confirm whether deployed kernels include the relevant stable commit.
  • Identify systems where the uvcvideo driver is loaded or available.
  • Review Debian LTS advisory status for Debian-hosted assets.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57980 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1, a31a4055473bf0a7b2b06cb2262347200d0711e1unaffected
LinuxLinux2.6.28, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.