Skip to content
Fencer Vulns
high 7.8

CVE-2024-57979 json

pps: Fix a use-after-free

published 2025-02-27 20 mo ago modified 2026-10-15 25 d ago also EUVD-2025-5270

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

pps: Fix a use-after-free

On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting:

pps pps1: removed ------------[ cut here ]------------ kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called. WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150 CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1 Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kobject_put+0x120/0x150 lr : kobject_put+0x120/0x150 sp : ffffffc0803d3ae0 x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001 x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440 x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600 x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20 x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: kobject_put+0x120/0x150 cdev_put+0x20/0x3c __fput+0x2c4/0x2d8 ____fput+0x1c/0x38 task_work_run+0x70/0xfc do_exit+0x2a0/0x924 do_group_exit+0x34/0x90 get_signal+0x7fc/0x8c0 do_signal+0x128/0x13b4 do_notify_resume+0xdc/0x160 el0_svc+0xd4/0xf8 el0t_64_sync_handler+0x140/0x14c el0t_64_sync+0x190/0x194 ---[ end trace 0000000000000000 ]---

...followed by more symptoms of corruption, with similar stacks:

refcount_t: underflow; use-after-free. kernel BUG at lib/list_debug.c:62! Kernel panic - not syncing: Oops - BUG: Fatal exception

This happens because pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(), but, as the comment above cdev_del() notes, fops for previously opened cdevs are still callable even after cdev_del() returns. I think this bug has always been there: I can't explain why it suddenly started happening every time I reboot this particular board.

In commit d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source."), George Spelvin suggested removing the embedded cdev. That seems like the simplest way to fix this, so I've implemented his suggestion, using __register_chrdev() with pps_idr becoming the source of truth for which minor corresponds to which device.

But now that pps_idr defines userspace visibility instead of cdev_add(), we need to be sure the pps->dev refcount can't reach zero while userspace can still find it again. So, the idr_remove() call moves to pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.

pps_core: source serial1 got cdev (251:1) <...> pps pps1: removed pps_core: unregistering pps1 pps_core: deallocating pps1

Patch / fix

  • Linux Linux 3.3, 3.5, 3.9, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14
  • linux Debian 12 6.1.129-1
  • linux Debian 14, Debian 13 6.12.13-1

debian advisories DEBIAN-CVE-2024-57979

  • linux Ubuntu 20.04 LTS 5.4.0-216.236
  • linux Ubuntu 22.04 LTS 5.15.0-140.150
  • linux Ubuntu 24.04 LTS 6.8.0-64.67
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1146.156
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1084.91
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1032.34
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1149.158
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1083.92

ubuntu advisories UBUNTU-CVE-2024-57979

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 8 4.18.0-553.44.1.el8_10
  • perf RHEL 8 4.18.0-553.44.1.el8_10
  • bpftool RHEL 8 4.18.0-553.44.1.el8_10
  • kernel-core RHEL 8 4.18.0-553.44.1.el8_10
  • kernel-tools RHEL 8 4.18.0-553.44.1.el8_10
  • python3-perf RHEL 8 4.18.0-553.44.1.el8_10
  • kernel-modules RHEL 8 4.18.0-553.44.1.el8_10
  • kernel-zfcpdump RHEL 8 4.18.0-553.44.1.el8_10

red hat advisories RHSA-2025:2473RHSA-2025:2474

  • kernel-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-syms-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-coco_debug SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-source-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
  • kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
  • kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
  • kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1.21.6

suse advisories SUSE-SU-2025:01919-1SUSE-SU-2025:20192-1SUSE-SU-2025:20270-1SUSE-SU-2025:20190-1SUSE-SU-2025:20260-1SUSE-SU-2025:1293-1

  • kernel AlmaLinux 8 4.18.0-553.44.1.el8_10
  • perf AlmaLinux 8 4.18.0-553.44.1.el8_10
  • bpftool AlmaLinux 8 4.18.0-553.44.1.el8_10
  • kernel-core AlmaLinux 8 4.18.0-553.44.1.el8_10
  • kernel-tools AlmaLinux 8 4.18.0-553.44.1.el8_10
  • python3-perf AlmaLinux 8 4.18.0-553.44.1.el8_10
  • kernel-modules AlmaLinux 8 4.18.0-553.44.1.el8_10
  • kernel-zfcpdump AlmaLinux 8 4.18.0-553.44.1.el8_10

almalinux advisories ALSA-2025:2473ALSA-2025:2474

  • kernel-rt Rocky Linux 8 4.18.0-553.44.1.rt7.385.el8_10
  • kernel Rocky Linux 8 4.18.0-553.44.1.el8_10

rocky linux advisories RLSA-2025:2474RLSA-2025:2473

  • kernel CBL-Mariner 2.0 5.15.180.1-1

azure linux advisories AZL-58992

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-57979 updated cvss 6.4

kernel: pps: Fix a use-after-free

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    affected: workaround, no fix planned “To mitigate this issue, prevent module pps_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.”
  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: workaround, no fix available “To mitigate this issue, prevent module pps_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.”
  • Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more Red Hat Enterprise Linux 10 kernel
    affected: workaround, no fix planned “To mitigate this issue, prevent module pps_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.”
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.44.1.el8_10, kernel 4.18.0-553.44.1.el8_10, bpftool 4.18.0-553.44.1.el8_10, kernel-core 4.18.0-553.44.1.el8_10, kernel-tools 4.18.0-553.44.1.el8_10, python3-perf 4.18.0-553.44.1.el8_10, +15 more Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.44.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.44.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.44.1.el8_10
    fixed: vendor fix “To mitigate this issue, prevent module pps_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:2473
  • Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-kvm 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-core 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-modules 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-debug-kvm 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-debug-core 4.18.0-553.44.1.rt7.385.el8_10, +4 more Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-core 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-modules 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-debug-core 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-debug-modules 4.18.0-553.44.1.rt7.385.el8_10, kernel-rt-modules-extra 4.18.0-553.44.1.rt7.385.el8_10, +2 more
    fixed: vendor fix “To mitigate this issue, prevent module pps_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:2474

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-11 updated cvss 7.8

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.7 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.7
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-295-16 updated cvss 7.8

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-209-04 updated cvss 7.8

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.6 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.6
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-01 updated cvss 7.8

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.