CVE-2024-56766

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A double free vulnerability was found in the Linux kernel's mtd: rawnand module, specifically in the atmel pmecc create user() function. The issue occurred because the "user" pointer was converted from being allocated with kzalloc() to being allocated by devm kzalloc(), and calling kfree(user) would lead to a double free.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the atmel pmecc create user() function until a patch is available.