{"id":"CVE-2024-47747","revision":"6c55c23d8a2d4f90b7d0c875177a568b","records":[{"revision":"6c55c23d8a2d4f90b7d0c875177a568b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-47747","aliases":[],"title":"net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition\n\nIn the ether3_probe function, a timer is initialized with a callback\nfunction ether3_ledoff, bound to &prev(dev)->timer. Once the timer is\nstarted, there is a risk of a race condition if the module or device\nis removed, triggering the ether3_remove function to perform cleanup.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                      |  ether3_ledoff\nether3_remove         |\n  free_netdev(dev);   |\n  put_devic           |\n  kfree(dev);         |\n |  ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);\n                      | // use dev\n\nFix it by ensuring that the timer is canceled before proceeding with\nthe cleanup in ether3_remove.","state":0,"publishedAt":"2024-10-21T12:14:13.783+00:00","modifiedAt":"2026-10-15T00:53:05.77+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/seeq/ether3.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"25d559ed2beec9b34045886100dac46d1ad92eba\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"338a0582b28e69460df03af50e938b86b4206353\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"822c7bb1f6f8b0331e8d1927151faf8db3b33afd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"1c57d61a43293252ad732007c7070fdb112545fd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"d2abc379071881798d20e2ac1d332ad855ae22f3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"516dbc6d16637430808c39568cbb6b841d32b55b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"77a77331cef0a219b8dd91361435eeef04cb741c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6fd9c53f71862a4797b7ed8a5de80e2c64829f56\",\n                            \"lessThan\": \"b5109b60ee4fcb2f2bb24f589575e10cc5283ad4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/seeq/ether3.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.323\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.285\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.227\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.168\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.113\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.54\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.10.13\",\n                            \"lessThanOrEqual\": \"6.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.2\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/25d559ed2beec9b34045886100dac46d1ad92eba","https://git.kernel.org/stable/c/b5a84b6c772564c8359a9a0fbaeb2a2944aa1ee9","https://git.kernel.org/stable/c/338a0582b28e69460df03af50e938b86b4206353","https://git.kernel.org/stable/c/822c7bb1f6f8b0331e8d1927151faf8db3b33afd","https://git.kernel.org/stable/c/1c57d61a43293252ad732007c7070fdb112545fd","https://git.kernel.org/stable/c/d2abc379071881798d20e2ac1d332ad855ae22f3","https://git.kernel.org/stable/c/516dbc6d16637430808c39568cbb6b841d32b55b","https://git.kernel.org/stable/c/77a77331cef0a219b8dd91361435eeef04cb741c","https://git.kernel.org/stable/c/b5109b60ee4fcb2f2bb24f589575e10cc5283ad4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-47747","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-47747","identifiers":["CVE-2024-47747"]},"retained":false,"historicalAffected":[]}],"coverage":[]}