{"id":"DEBIAN-CVE-2024-56554","details":"In the Linux kernel, the following vulnerability has been resolved:  binder: fix freeze UAF in binder_release_work()  When a binder reference is cleaned up, any freeze work queued in the associated process should also be removed. Otherwise, the reference is freed while its ref-\u003efreeze.work is still queued in proc-\u003ework leading to a use-after-free issue as shown by the following KASAN report:    ==================================================================   BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0   Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211    CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22   Hardware name: linux,dummy-virt (DT)   Workqueue: events binder_deferred_func   Call trace:    binder_release_work+0x398/0x3d0    binder_deferred_func+0xb60/0x109c    process_one_work+0x51c/0xbd4    worker_thread+0x608/0xee8    Allocated by task 703:    __kmalloc_cache_noprof+0x130/0x280    binder_thread_write+0xdb4/0x42a0    binder_ioctl+0x18f0/0x25ac    __arm64_sys_ioctl+0x124/0x190    invoke_syscall+0x6c/0x254    Freed by task 211:    kfree+0xc4/0x230    binder_deferred_func+0xae8/0x109c    process_one_work+0x51c/0xbd4    worker_thread+0x608/0xee8   ==================================================================  This commit fixes the issue by ensuring any queued freeze work is removed when cleaning up a binder reference.","modified":"2026-09-15T09:03:16.731897990Z","published":"2024-12-27T15:15:14.183Z","upstream":["CVE-2024-56554"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-56554"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-56554.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-56554.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}