CVE-2024-39493

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a memory leak in the crypto component of the Linux kernel, specifically in the qat (Quick Assist Technology) module. The problem arises when using completion done to determine if the caller has gone away, which only works after a complete call. Additionally, there's a possibility that the caller has not yet called wait for completion, resulting in another potential use-after-free (UAF). The fix involves making the caller use cancel work sync and then freeing the memory safely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.