{"id":"DEBIAN-CVE-2024-46746","details":"In the Linux kernel, the following vulnerability has been resolved:  HID: amd_sfh: free driver_data after destroying hid device  HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks.  I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output:    [   13.050438] ==================================================================   [   13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]   [   13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3   [   13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479    [   13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0   [   13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024   [   13.067860] Call Trace:   [   13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8   [   13.071486]  \u003cTASK\u003e   [   13.071492]  dump_stack_lvl+0x5d/0x80   [   13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -\u003e 0002)   [   13.078296]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.082199]  print_report+0x174/0x505   [   13.085776]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10   [   13.089367]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.093255]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.097464]  kasan_report+0xc8/0x150   [   13.101461]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.105802]  amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.110303]  amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]   [   13.114879]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.119450]  sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]   [   13.124097]  hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]   [   13.127404]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.131925]  ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]   [   13.136455]  ? _raw_spin_lock_irqsave+0x96/0xf0   [   13.140197]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10   [   13.143602]  ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]   [   13.147234]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.150446]  ? __devm_add_action+0x167/0x1d0   [   13.155061]  hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]   [   13.158581]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.161814]  platform_probe+0xa2/0x150   [   13.165029]  really_probe+0x1e3/0x8a0   [   13.168243]  __driver_probe_device+0x18c/0x370   [   13.171500]  driver_probe_device+0x4a/0x120   [   13.175000]  __driver_attach+0x190/0x4a0   [   13.178521]  ? __pfx___driver_attach+0x10/0x10   [   13.181771]  bus_for_each_dev+0x106/0x180   [   13.185033]  ? __pfx__raw_spin_lock+0x10/0x10   [   13.188229]  ? __pfx_bus_for_each_dev+0x10/0x10   [   13.191446]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.194382]  bus_add_driver+0x29e/0x4d0   [   13.197328]  driver_register+0x1a5/0x360   [   13.200283]  ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]   [   13.203362]  do_one_initcall+0xa7/0x380   [   13.206432]  ? __pfx_do_one_initcall+0x10/0x10   [   13.210175]  ? srso_alias_return_thunk+0x5/0xfbef5   [   13.213211]  ? kasan_unpoison+0x44/0x70   [   13.216688]  do_init_module+0x238/0x750   [   13.2196 ---truncated---","modified":"2026-09-15T09:03:11.621596057Z","published":"2024-09-18T08:15:03.730Z","upstream":["CVE-2024-46746"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-46746"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.112-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-46746.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-46746.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-46746.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}