LiveActive security incident?Get immediate response
CVE Record

CVE-2024-58079: media: uvcvideo: Fix crash during unbind if gpio unit is in use

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled. If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS. We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete. Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash bug in the USB video driver. It has limited business impact because the source says it only affects devices with GPIO units and requires unbinding the USB interface; ordinary disconnects do not trigger it.

Executive priority

Treat as routine patch management unless your environment depends on Linux hosts with USB video GPIO hardware. The credible outcome is system instability, not confirmed remote compromise.

Technical view

uvcvideo used the wrong device for managed cleanup, leaving an IRQ enabled after driver unbind. A later IRQ can access freed memory and cause a kernel OOPS. The fix changes cleanup handling because devm_request_threaded_irq is unsafe for this lifecycle.

Likely exposure

Exposure is most plausible on Linux systems using UVC USB video devices with GPIO units. The provided data lists Linux kernel affected ranges and fixed stable references, but no product-specific inventory beyond Linux is provided.

Exploitation context

The bundle does not show KEV listing or active exploitation. Trigger conditions appear local and narrow: the user must unbind the driver from the USB interface while an affected GPIO unit is in use.

Researcher notes

Evidence is limited to kernel stable commits, the CVE record, and Debian LTS notice. No CVSS, CWE, exploit report, or broader affected product mapping is present in the bundle.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • For Debian systems, review and apply the linked Debian LTS kernel advisory.
  • Avoid manual uvcvideo interface unbind operations on affected systems until patched.
  • Check distribution security guidance for exact package versions and reboot requirements.

Validation and detection

  • Inventory Linux hosts using UVC USB video devices with GPIO units.
  • Compare running kernel builds against vendor advisories and stable fix commits.
  • Review kernel logs for uvcvideo OOPS events during driver unbind.
  • Confirm patched kernels are booted, not merely installed.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-58079 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28unaffected
LinuxLinux5.12, 0, 5.15.179, 6.1.130, 6.6.78, 6.12.14, 6.13.3, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.