CVE-2024-44971

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()

bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak.

This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

VendorProductVersions
LinuxLinux>= 771089c2a485958e423f305e974303760167b45c, < b7b8d9f5e679af60c94251fd6728dde34be69a71; >= 771089c2a485958e423f305e974303760167b45c, < c05516c072903f6fb9134b8e7e1ad4bffcdc4819; >= 771089c2a485958e423f305e974303760167b45c, < 7feef10768ea71d468d9bbc1e0d14c461876768c; >= 771089c2a485958e423f305e974303760167b45c, < a7d2808d67570e6acae45c2a96e0d59986888e4c; >= 771089c2a485958e423f305e974303760167b45c, < f3d5efe18a11f94150fee8b3fda9d62079af640a; >= 771089c2a485958e423f305e974303760167b45c, < e3862093ee93fcfbdadcb7957f5f8974fffa806a
LinuxLinux5.10

References

Timeline

Published
Sep 4, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-449735.5In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call do_slab_free for kfence object In 782f8906f805 tCVE-2024-449747.8In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_addressCVE-2024-449755.5In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: fix panic caused by partcmd_update We find a bug as belCVE-2024-449765.5In the Linux kernel, the following vulnerability has been resolved: ata: pata_macio: Fix DMA table overflow Kolbjørn and Jonáš reported thCVE-2024-449777.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to aCVE-2024-449787.8In the Linux kernel, the following vulnerability has been resolved: drm/xe: Free job before xe_exec_queue_put Free job depends on job->vm CVE-2024-449795.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing workqueue destroy in xe_gt_pagefault On driver relCVE-2024-44987.7A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to tCVE-2024-449805.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix opregion leak Being part o the display, ideally the setup CVE-2024-449815.5In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() CVE-2024-449825.5In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpuCVE-2024-449837.1In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient
CVE-2024-44971: Medium severity, CVSS 5.5 | Vulnix