CVE-2024-26653

What it actually does

Double free of platform_data passed to ljca_new_client_device when auxiliary_device_add fails after auxiliary_device_init succeeds, due to redundant kfree in callers and missing early error cleanup in the ljca auxiliary device release path.

Why it matters to the business

Local memory corruption on Linux systems using the ljca USB misc driver can lead to kernel crashes, denial of service, or potential privilege escalation; widespread in kernel distributions but low exploitation likelihood and no ransomware usage observed.

How an attack unfolds

An attacker with local access triggers an error path in ljca_new_client_device by causing auxiliary_device_add to fail after init, resulting in the release callback freeing platform_data followed by a second kfree from the caller, corrupting kernel memory structures.

How to fix it

Update the Linux kernel to a version containing commit 420babea4f1881a7c4ea22a8e218b8c6895d3f21 or later; remove all redundant kfree calls on platform_data in error paths of ljca_new_client_device callers and ensure kfree occurs only for pre-init errors.

How to confirm the fix worked

Confirm kernel source contains the fix commit; build and boot test the ljca driver error paths; inspect for absence of double kfree patterns around auxiliary_device_add and ljca_auxdev_release.

Typical attack path

1. Obtain local code execution or user privileges on affected Linux kernel
2. Invoke ljca_new_client_device and force auxiliary_device_add failure after auxiliary_device_init
3. Trigger double kfree of platform_data via error handling in callers and ljca_auxdev_release
4. Exploit resulting memory state for crash or further corruption

How to detect it

Search kernel logs and crash dumps for repeated kfree or slab corruption warnings involving platform_data or ljca auxiliary devices; examine audit logs for unusual local process activity around USB device registration failures.

What your security team should do

• Prioritize kernel upgrade to fixed commit on all affected systems within standard patch cycles
• Monitor for local privilege escalation attempts involving USB misc drivers
• Review downstream kernel packages for backports of the double-free cleanup