{"id":"DEBIAN-CVE-2024-58056","details":"In the Linux kernel, the following vulnerability has been resolved:  remoteproc: core: Fix ida_free call while not allocated  In the rproc_alloc() function, on error, put_device(&rproc-\u003edev) is called, leading to the call of the rproc_type_release() function. An error can occurs before ida_alloc is called.  In such case in rproc_type_release(), the condition (rproc-\u003eindex \u003e= 0) is true as rproc-\u003eindex has been  initialized to 0. ida_free() is called reporting a warning: [    4.181906] WARNING: CPU: 1 PID: 24 at lib/idr.c:525 ida_free+0x100/0x164 [    4.186378] stm32-display-dsi 5a000000.dsi: Fixed dependency cycle(s) with /soc/dsi@5a000000/panel@0 [    4.188854] ida_free called for id=0 which is not allocated. [    4.198256] mipi-dsi 5a000000.dsi.0: Fixed dependency cycle(s) with /soc/dsi@5a000000 [    4.203556] Modules linked in: panel_orisetech_otm8009a dw_mipi_dsi_stm(+) gpu_sched dw_mipi_dsi stm32_rproc stm32_crc32 stm32_ipcc(+) optee(+) [    4.224307] CPU: 1 UID: 0 PID: 24 Comm: kworker/u10:0 Not tainted 6.12.0 #442 [    4.231481] Hardware name: STM32 (Device Tree Support) [    4.236627] Workqueue: events_unbound deferred_probe_work_func [    4.242504] Call trace: [    4.242522]  unwind_backtrace from show_stack+0x10/0x14 [    4.250218]  show_stack from dump_stack_lvl+0x50/0x64 [    4.255274]  dump_stack_lvl from __warn+0x80/0x12c [    4.260134]  __warn from warn_slowpath_fmt+0x114/0x188 [    4.265199]  warn_slowpath_fmt from ida_free+0x100/0x164 [    4.270565]  ida_free from rproc_type_release+0x38/0x60 [    4.275832]  rproc_type_release from device_release+0x30/0xa0 [    4.281601]  device_release from kobject_put+0xc4/0x294 [    4.286762]  kobject_put from rproc_alloc.part.0+0x208/0x28c [    4.292430]  rproc_alloc.part.0 from devm_rproc_alloc+0x80/0xc4 [    4.298393]  devm_rproc_alloc from stm32_rproc_probe+0xd0/0x844 [stm32_rproc] [    4.305575]  stm32_rproc_probe [stm32_rproc] from platform_probe+0x5c/0xbc  Calling ida_alloc earlier in rproc_alloc ensures that the rproc-\u003eindex is properly set.","modified":"2026-09-15T09:03:18.111571701Z","published":"2025-03-06T16:15:51.837Z","upstream":["CVE-2024-58056"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-58056"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.129-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-58056.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-58056.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-58056.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}