GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-53194 (GCVE-0-2024-53194)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:49 – Updated: 2026-05-11 20:52
VLAI
Title
PCI: Fix use-after-free of slot->bus on hot remove
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-11 15:43 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < 50473dd3b2a08601a078f852ea05572de9b1f86c (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < d0ddd2c92b75a19a37c887154223372b600fed37 (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < da6e6ff1f6c57f16e07af955e0e997fc90dd1e75 (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < 41bbb1eb996be1435815aa1fbcc9ffc45b84cc12 (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < 20502f0b3f3acd6bee300257556c27a867f80c8b (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < e5d5c04aac71bf1476dc44b56f2206a4c2facca8 (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < c8266ab8e7ccd1d1f5a9c8b29eb2020175048134 (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < 69d2ceac11acf8579d58d55c9c5b65fb658f916e (git)
Affected: f46753c5e354b857b20ab8e0fe7b2579831dc369 , < c7acef99642b763ba585f4a43af999fcdbcc3dc4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 4.19.325 , ≤ 4.19.* (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:43:25.841090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:26.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:47:25.631Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/slot.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50473dd3b2a08601a078f852ea05572de9b1f86c",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "d0ddd2c92b75a19a37c887154223372b600fed37",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "da6e6ff1f6c57f16e07af955e0e997fc90dd1e75",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "41bbb1eb996be1435815aa1fbcc9ffc45b84cc12",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "20502f0b3f3acd6bee300257556c27a867f80c8b",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "e5d5c04aac71bf1476dc44b56f2206a4c2facca8",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "c8266ab8e7ccd1d1f5a9c8b29eb2020175048134",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "69d2ceac11acf8579d58d55c9c5b65fb658f916e",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            },
            {
              "lessThan": "c7acef99642b763ba585f4a43af999fcdbcc3dc4",
              "status": "affected",
              "version": "f46753c5e354b857b20ab8e0fe7b2579831dc369",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/slot.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.325",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.325",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix use-after-free of slot-\u003ebus on hot remove\n\nDennis reports a boot crash on recent Lenovo laptops with a USB4 dock.\n\nSince commit 0fc70886569c (\"thunderbolt: Reset USB4 v2 host router\") and\ncommit 59a54c5f3dbd (\"thunderbolt: Reset topology created by the boot\nfirmware\"), USB4 v2 and v1 Host Routers are reset on probe of the\nthunderbolt driver.\n\nThe reset clears the Presence Detect State and Data Link Layer Link Active\nbits at the USB4 Host Router\u0027s Root Port and thus causes hot removal of the\ndock.\n\nThe crash occurs when pciehp is unbound from one of the dock\u0027s Downstream\nPorts:  pciehp creates a pci_slot on bind and destroys it on unbind.  The\npci_slot contains a pointer to the pci_bus below the Downstream Port, but\na reference on that pci_bus is never acquired.  The pci_bus is destroyed\nbefore the pci_slot, so a use-after-free ensues when pci_slot_release()\naccesses slot-\u003ebus.\n\nIn principle this should not happen because pci_stop_bus_device() unbinds\npciehp (and therefore destroys the pci_slot) before the pci_bus is\ndestroyed by pci_remove_bus_device().\n\nHowever the stacktrace provided by Dennis shows that pciehp is unbound from\npci_remove_bus_device() instead of pci_stop_bus_device().  To understand\nthe significance of this, one needs to know that the PCI core uses a two\nstep process to remove a portion of the hierarchy:  It first unbinds all\ndrivers in the sub-hierarchy in pci_stop_bus_device() and then actually\nremoves the devices in pci_remove_bus_device().  There is no precaution to\nprevent driver binding in-between pci_stop_bus_device() and\npci_remove_bus_device().\n\nIn Dennis\u0027 case, it seems removal of the hierarchy by pciehp races with\ndriver binding by pci_bus_add_devices().  pciehp is bound to the\nDownstream Port after pci_stop_bus_device() has run, so it is unbound by\npci_remove_bus_device() instead of pci_stop_bus_device().  Because the\npci_bus has already been destroyed at that point, accesses to it result in\na use-after-free.\n\nOne might conclude that driver binding needs to be prevented after\npci_stop_bus_device() has run.  However it seems risky that pci_slot points\nto pci_bus without holding a reference.  Solely relying on correct ordering\nof driver unbind versus pci_bus destruction is certainly not defensive\nprogramming.\n\nIf pci_slot has a need to access data in pci_bus, it ought to acquire a\nreference.  Amend pci_create_slot() accordingly.  Dennis reports that the\ncrash is not reproducible with this change.\n\nAbridged stacktrace:\n\n  pcieport 0000:00:07.0: PME: Signaling with IRQ 156\n  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+\n  pci_bus 0000:20: dev 00, created physical slot 12\n  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present\n  ...\n  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0\n  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1\n  RIP: 0010:dev_driver_string+0x12/0x40\n  pci_destroy_slot\n  pciehp_remove\n  pcie_port_remove_service\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  device_unregister\n  remove_iter\n  device_for_each_child\n  pcie_portdrv_remove\n  pci_device_remove\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  pci_remove_bus_device (recursive invocation)\n  pci_remove_bus_device\n  pciehp_unconfigure_device\n  pciehp_disable_slot\n  pciehp_handle_presence_or_link_change\n  pciehp_ist"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:52:39.806Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50473dd3b2a08601a078f852ea05572de9b1f86c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0ddd2c92b75a19a37c887154223372b600fed37"
        },
        {
          "url": "https://git.kernel.org/stable/c/da6e6ff1f6c57f16e07af955e0e997fc90dd1e75"
        },
        {
          "url": "https://git.kernel.org/stable/c/41bbb1eb996be1435815aa1fbcc9ffc45b84cc12"
        },
        {
          "url": "https://git.kernel.org/stable/c/20502f0b3f3acd6bee300257556c27a867f80c8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5d5c04aac71bf1476dc44b56f2206a4c2facca8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8266ab8e7ccd1d1f5a9c8b29eb2020175048134"
        },
        {
          "url": "https://git.kernel.org/stable/c/69d2ceac11acf8579d58d55c9c5b65fb658f916e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7acef99642b763ba585f4a43af999fcdbcc3dc4"
        }
      ],
      "title": "PCI: Fix use-after-free of slot-\u003ebus on hot remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53194",
    "datePublished": "2024-12-27T13:49:36.534Z",
    "dateReserved": "2024-11-19T17:17:25.014Z",
    "dateUpdated": "2026-05-11T20:52:39.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53194",
      "date": "2026-09-16",
      "epss": "0.00234",
      "percentile": "0.14522"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI: Fix use-after-free of slot-\u003ebus on hot remove\\n\\nDennis reports a boot crash on recent Lenovo laptops with a USB4 dock.\\n\\nSince commit 0fc70886569c (\\\"thunderbolt: Reset USB4 v2 host router\\\") and\\ncommit 59a54c5f3dbd (\\\"thunderbolt: Reset topology created by the boot\\nfirmware\\\"), USB4 v2 and v1 Host Routers are reset on probe of the\\nthunderbolt driver.\\n\\nThe reset clears the Presence Detect State and Data Link Layer Link Active\\nbits at the USB4 Host Router\u0027s Root Port and thus causes hot removal of the\\ndock.\\n\\nThe crash occurs when pciehp is unbound from one of the dock\u0027s Downstream\\nPorts:  pciehp creates a pci_slot on bind and destroys it on unbind.  The\\npci_slot contains a pointer to the pci_bus below the Downstream Port, but\\na reference on that pci_bus is never acquired.  The pci_bus is destroyed\\nbefore the pci_slot, so a use-after-free ensues when pci_slot_release()\\naccesses slot-\u003ebus.\\n\\nIn principle this should not happen because pci_stop_bus_device() unbinds\\npciehp (and therefore destroys the pci_slot) before the pci_bus is\\ndestroyed by pci_remove_bus_device().\\n\\nHowever the stacktrace provided by Dennis shows that pciehp is unbound from\\npci_remove_bus_device() instead of pci_stop_bus_device().  To understand\\nthe significance of this, one needs to know that the PCI core uses a two\\nstep process to remove a portion of the hierarchy:  It first unbinds all\\ndrivers in the sub-hierarchy in pci_stop_bus_device() and then actually\\nremoves the devices in pci_remove_bus_device().  There is no precaution to\\nprevent driver binding in-between pci_stop_bus_device() and\\npci_remove_bus_device().\\n\\nIn Dennis\u0027 case, it seems removal of the hierarchy by pciehp races with\\ndriver binding by pci_bus_add_devices().  pciehp is bound to the\\nDownstream Port after pci_stop_bus_device() has run, so it is unbound by\\npci_remove_bus_device() instead of pci_stop_bus_device().  Because the\\npci_bus has already been destroyed at that point, accesses to it result in\\na use-after-free.\\n\\nOne might conclude that driver binding needs to be prevented after\\npci_stop_bus_device() has run.  However it seems risky that pci_slot points\\nto pci_bus without holding a reference.  Solely relying on correct ordering\\nof driver unbind versus pci_bus destruction is certainly not defensive\\nprogramming.\\n\\nIf pci_slot has a need to access data in pci_bus, it ought to acquire a\\nreference.  Amend pci_create_slot() accordingly.  Dennis reports that the\\ncrash is not reproducible with this change.\\n\\nAbridged stacktrace:\\n\\n  pcieport 0000:00:07.0: PME: Signaling with IRQ 156\\n  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+\\n  pci_bus 0000:20: dev 00, created physical slot 12\\n  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present\\n  ...\\n  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0\\n  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1\\n  RIP: 0010:dev_driver_string+0x12/0x40\\n  pci_destroy_slot\\n  pciehp_remove\\n  pcie_port_remove_service\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  device_unregister\\n  remove_iter\\n  device_for_each_child\\n  pcie_portdrv_remove\\n  pci_device_remove\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  pci_remove_bus_device (recursive invocation)\\n  pci_remove_bus_device\\n  pciehp_unconfigure_device\\n  pciehp_disable_slot\\n  pciehp_handle_presence_or_link_change\\n  pciehp_ist\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI: Fix use-after-free of slot-\u0026gt;bus on hot remove Dennis informa un fallo de arranque en port\\u00e1tiles Lenovo recientes con un dock USB4. Desde el commit 0fc70886569c (\\\"thunderbolt: Reset USB4 v2 host router\\\") y el commit 59a54c5f3dbd (\\\"thunderbolt: Reset topology created by the boot firmware\\\"), los routers host USB4 v2 y v1 se restablecen al sondear el controlador Thunderbolt. El restablecimiento borra los bits de estado de detecci\\u00f3n de presencia y de enlace de capa de enlace de datos activo en el puerto ra\\u00edz del router host USB4 y, por lo tanto, provoca la eliminaci\\u00f3n en caliente del dock. El fallo se produce cuando pciehp se desvincula de uno de los puertos de bajada del dock: pciehp crea un pci_slot al vincularlo y lo destruye al desvincularlo. El pci_slot contiene un puntero al pci_bus debajo del puerto de bajada, pero nunca se adquiere una referencia en ese pci_bus. El pci_bus se destruye antes que el pci_slot, por lo que se produce un use-after-free cuando pci_slot_release() accede a slot-\u0026gt;bus. En principio, esto no deber\\u00eda suceder porque pci_stop_bus_device() desvincula pciehp (y, por lo tanto, destruye el pci_slot) antes de que pci_remove_bus_device() destruya el pci_bus. Sin embargo, el seguimiento de la pila proporcionado por Dennis muestra que pciehp se desvincula de pci_remove_bus_device() en lugar de pci_stop_bus_device(). Para comprender la importancia de esto, es necesario saber que el n\\u00facleo PCI utiliza un proceso de dos pasos para eliminar una parte de la jerarqu\\u00eda: primero desvincula todos los controladores en la subjerarqu\\u00eda en pci_stop_bus_device() y luego elimina los dispositivos en pci_remove_bus_device(). No hay ninguna precauci\\u00f3n para evitar la vinculaci\\u00f3n del controlador entre pci_stop_bus_device() y pci_remove_bus_device(). En el caso de Dennis, parece que la eliminaci\\u00f3n de la jerarqu\\u00eda por parte de pciehp compite con la vinculaci\\u00f3n del controlador por parte de pci_bus_add_devices(). pciehp est\\u00e1 vinculado al puerto descendente despu\\u00e9s de que se haya ejecutado pci_stop_bus_device(), por lo que se desvincula mediante pci_remove_bus_device() en lugar de pci_stop_bus_device(). Debido a que pci_bus ya se ha destruido en ese punto, los accesos a \\u00e9l dan como resultado un use-after-free. Se podr\\u00eda concluir que es necesario evitar la vinculaci\\u00f3n del controlador despu\\u00e9s de que se haya ejecutado pci_stop_bus_device(). Sin embargo, parece arriesgado que pci_slot apunte a pci_bus sin contener una referencia. Confiar \\u00fanicamente en el orden correcto de la desvinculaci\\u00f3n del controlador frente a la destrucci\\u00f3n de pci_bus ciertamente no es programaci\\u00f3n defensiva. Si pci_slot necesita acceder a datos en pci_bus, debe adquirir una referencia. Modifique pci_create_slot() en consecuencia. Dennis informa que el bloqueo no se puede reproducir con este cambio. Rastreo de pila abreviado: pcieport 0000:00:07.0: PME: Se\\u00f1alizaci\\u00f3n con IRQ 156 pcieport 0000:00:07.0: pciehp: Ranura n.\\u00ba 12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, cre\\u00f3 la ranura f\\u00edsica 12 pcieport 0000:00:07.0: pciehp: Ranura (12): Tarjeta no presente... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 comando de escritura 0 Oops: error de protecci\\u00f3n general, probablemente para una direcci\\u00f3n no can\\u00f3nica 0x6b6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp No contaminado 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 ranura de destrucci\\u00f3n pci pciehp_remove servicio de eliminaci\\u00f3n de puerto pcie dispositivo de liberaci\\u00f3n de controlador interno de bus eliminar dispositivo_eliminar_dispositivo anular_registro_dispositivo eliminar_iter dispositivo_para_cada_hijo_eliminar_puerto_pcie dispositivo_eliminar_dispositivo_liberaci\\u00f3n_controlador_interno_bus_eliminar_dispositivo dispositivo_eliminar pci_remove_bus_device (invocaci\\u00f3n recursiva) -- truncado----\"}]",
      "id": "CVE-2024-53194",
      "lastModified": "2024-12-27T14:15:27.007",
      "published": "2024-12-27T14:15:27.007",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/20502f0b3f3acd6bee300257556c27a867f80c8b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/41bbb1eb996be1435815aa1fbcc9ffc45b84cc12\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/50473dd3b2a08601a078f852ea05572de9b1f86c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/69d2ceac11acf8579d58d55c9c5b65fb658f916e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c7acef99642b763ba585f4a43af999fcdbcc3dc4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c8266ab8e7ccd1d1f5a9c8b29eb2020175048134\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d0ddd2c92b75a19a37c887154223372b600fed37\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/da6e6ff1f6c57f16e07af955e0e997fc90dd1e75\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e5d5c04aac71bf1476dc44b56f2206a4c2facca8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53194\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:27.007\",\"lastModified\":\"2026-06-17T08:08:33.487\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI: Fix use-after-free of slot-\u003ebus on hot remove\\n\\nDennis reports a boot crash on recent Lenovo laptops with a USB4 dock.\\n\\nSince commit 0fc70886569c (\\\"thunderbolt: Reset USB4 v2 host router\\\") and\\ncommit 59a54c5f3dbd (\\\"thunderbolt: Reset topology created by the boot\\nfirmware\\\"), USB4 v2 and v1 Host Routers are reset on probe of the\\nthunderbolt driver.\\n\\nThe reset clears the Presence Detect State and Data Link Layer Link Active\\nbits at the USB4 Host Router\u0027s Root Port and thus causes hot removal of the\\ndock.\\n\\nThe crash occurs when pciehp is unbound from one of the dock\u0027s Downstream\\nPorts:  pciehp creates a pci_slot on bind and destroys it on unbind.  The\\npci_slot contains a pointer to the pci_bus below the Downstream Port, but\\na reference on that pci_bus is never acquired.  The pci_bus is destroyed\\nbefore the pci_slot, so a use-after-free ensues when pci_slot_release()\\naccesses slot-\u003ebus.\\n\\nIn principle this should not happen because pci_stop_bus_device() unbinds\\npciehp (and therefore destroys the pci_slot) before the pci_bus is\\ndestroyed by pci_remove_bus_device().\\n\\nHowever the stacktrace provided by Dennis shows that pciehp is unbound from\\npci_remove_bus_device() instead of pci_stop_bus_device().  To understand\\nthe significance of this, one needs to know that the PCI core uses a two\\nstep process to remove a portion of the hierarchy:  It first unbinds all\\ndrivers in the sub-hierarchy in pci_stop_bus_device() and then actually\\nremoves the devices in pci_remove_bus_device().  There is no precaution to\\nprevent driver binding in-between pci_stop_bus_device() and\\npci_remove_bus_device().\\n\\nIn Dennis\u0027 case, it seems removal of the hierarchy by pciehp races with\\ndriver binding by pci_bus_add_devices().  pciehp is bound to the\\nDownstream Port after pci_stop_bus_device() has run, so it is unbound by\\npci_remove_bus_device() instead of pci_stop_bus_device().  Because the\\npci_bus has already been destroyed at that point, accesses to it result in\\na use-after-free.\\n\\nOne might conclude that driver binding needs to be prevented after\\npci_stop_bus_device() has run.  However it seems risky that pci_slot points\\nto pci_bus without holding a reference.  Solely relying on correct ordering\\nof driver unbind versus pci_bus destruction is certainly not defensive\\nprogramming.\\n\\nIf pci_slot has a need to access data in pci_bus, it ought to acquire a\\nreference.  Amend pci_create_slot() accordingly.  Dennis reports that the\\ncrash is not reproducible with this change.\\n\\nAbridged stacktrace:\\n\\n  pcieport 0000:00:07.0: PME: Signaling with IRQ 156\\n  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+\\n  pci_bus 0000:20: dev 00, created physical slot 12\\n  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present\\n  ...\\n  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0\\n  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1\\n  RIP: 0010:dev_driver_string+0x12/0x40\\n  pci_destroy_slot\\n  pciehp_remove\\n  pcie_port_remove_service\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  device_unregister\\n  remove_iter\\n  device_for_each_child\\n  pcie_portdrv_remove\\n  pci_device_remove\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  pci_remove_bus_device (recursive invocation)\\n  pci_remove_bus_device\\n  pciehp_unconfigure_device\\n  pciehp_disable_slot\\n  pciehp_handle_presence_or_link_change\\n  pciehp_ist\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI: Fix use-after-free of slot-\u0026gt;bus on hot remove Dennis informa un fallo de arranque en port\u00e1tiles Lenovo recientes con un dock USB4. Desde el commit 0fc70886569c (\\\"thunderbolt: Reset USB4 v2 host router\\\") y el commit 59a54c5f3dbd (\\\"thunderbolt: Reset topology created by the boot firmware\\\"), los routers host USB4 v2 y v1 se restablecen al sondear el controlador Thunderbolt. El restablecimiento borra los bits de estado de detecci\u00f3n de presencia y de enlace de capa de enlace de datos activo en el puerto ra\u00edz del router host USB4 y, por lo tanto, provoca la eliminaci\u00f3n en caliente del dock. El fallo se produce cuando pciehp se desvincula de uno de los puertos de bajada del dock: pciehp crea un pci_slot al vincularlo y lo destruye al desvincularlo. El pci_slot contiene un puntero al pci_bus debajo del puerto de bajada, pero nunca se adquiere una referencia en ese pci_bus. El pci_bus se destruye antes que el pci_slot, por lo que se produce un use-after-free cuando pci_slot_release() accede a slot-\u0026gt;bus. En principio, esto no deber\u00eda suceder porque pci_stop_bus_device() desvincula pciehp (y, por lo tanto, destruye el pci_slot) antes de que pci_remove_bus_device() destruya el pci_bus. Sin embargo, el seguimiento de la pila proporcionado por Dennis muestra que pciehp se desvincula de pci_remove_bus_device() en lugar de pci_stop_bus_device(). Para comprender la importancia de esto, es necesario saber que el n\u00facleo PCI utiliza un proceso de dos pasos para eliminar una parte de la jerarqu\u00eda: primero desvincula todos los controladores en la subjerarqu\u00eda en pci_stop_bus_device() y luego elimina los dispositivos en pci_remove_bus_device(). No hay ninguna precauci\u00f3n para evitar la vinculaci\u00f3n del controlador entre pci_stop_bus_device() y pci_remove_bus_device(). En el caso de Dennis, parece que la eliminaci\u00f3n de la jerarqu\u00eda por parte de pciehp compite con la vinculaci\u00f3n del controlador por parte de pci_bus_add_devices(). pciehp est\u00e1 vinculado al puerto descendente despu\u00e9s de que se haya ejecutado pci_stop_bus_device(), por lo que se desvincula mediante pci_remove_bus_device() en lugar de pci_stop_bus_device(). Debido a que pci_bus ya se ha destruido en ese punto, los accesos a \u00e9l dan como resultado un use-after-free. Se podr\u00eda concluir que es necesario evitar la vinculaci\u00f3n del controlador despu\u00e9s de que se haya ejecutado pci_stop_bus_device(). Sin embargo, parece arriesgado que pci_slot apunte a pci_bus sin contener una referencia. Confiar \u00fanicamente en el orden correcto de la desvinculaci\u00f3n del controlador frente a la destrucci\u00f3n de pci_bus ciertamente no es programaci\u00f3n defensiva. Si pci_slot necesita acceder a datos en pci_bus, debe adquirir una referencia. Modifique pci_create_slot() en consecuencia. Dennis informa que el bloqueo no se puede reproducir con este cambio. Rastreo de pila abreviado: pcieport 0000:00:07.0: PME: Se\u00f1alizaci\u00f3n con IRQ 156 pcieport 0000:00:07.0: pciehp: Ranura n.\u00ba 12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, cre\u00f3 la ranura f\u00edsica 12 pcieport 0000:00:07.0: pciehp: Ranura (12): Tarjeta no presente... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 comando de escritura 0 Oops: error de protecci\u00f3n general, probablemente para una direcci\u00f3n no can\u00f3nica 0x6b6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp No contaminado 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 ranura de destrucci\u00f3n pci pciehp_remove servicio de eliminaci\u00f3n de puerto pcie dispositivo de liberaci\u00f3n de controlador interno de bus eliminar dispositivo_eliminar_dispositivo anular_registro_dispositivo eliminar_iter dispositivo_para_cada_hijo_eliminar_puerto_pcie dispositivo_eliminar_dispositivo_liberaci\u00f3n_controlador_interno_bus_eliminar_dispositivo dispositivo_eliminar pci_remove_bus_device (invocaci\u00f3n recursiva) -- truncado----\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pci/slot.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"50473dd3b2a08601a078f852ea05572de9b1f86c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"d0ddd2c92b75a19a37c887154223372b600fed37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"da6e6ff1f6c57f16e07af955e0e997fc90dd1e75\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"41bbb1eb996be1435815aa1fbcc9ffc45b84cc12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"20502f0b3f3acd6bee300257556c27a867f80c8b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"e5d5c04aac71bf1476dc44b56f2206a4c2facca8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"c8266ab8e7ccd1d1f5a9c8b29eb2020175048134\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"69d2ceac11acf8579d58d55c9c5b65fb658f916e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46753c5e354b857b20ab8e0fe7b2579831dc369\",\"lessThan\":\"c7acef99642b763ba585f4a43af999fcdbcc3dc4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pci/slot.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.27\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.27\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.325\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:43:25.841090Z\",\"id\":\"CVE-2024-53194\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.325\",\"matchCriteriaId\":\"96043CF8-5AF4-4DD9-9F49-9B7651C0EB7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.287\",\"matchCriteriaId\":\"E4B15788-D35E-4E5B-A9C0-070AE3729B34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/20502f0b3f3acd6bee300257556c27a867f80c8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41bbb1eb996be1435815aa1fbcc9ffc45b84cc12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50473dd3b2a08601a078f852ea05572de9b1f86c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69d2ceac11acf8579d58d55c9c5b65fb658f916e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7acef99642b763ba585f4a43af999fcdbcc3dc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8266ab8e7ccd1d1f5a9c8b29eb2020175048134\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0ddd2c92b75a19a37c887154223372b600fed37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da6e6ff1f6c57f16e07af955e0e997fc90dd1e75\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5d5c04aac71bf1476dc44b56f2206a4c2facca8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:15:14+00:00",
      "cve": "CVE-2024-53194",
      "id": "CVE-2024-53194",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: PCI: Fix use-after-free of slot-\u003ebus on hot remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53194.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:56:32Z",
      "cve": "CVE-2024-53194",
      "id": "CVE-2024-53194",
      "initial_release_date": "2024-12-28T03:50:31Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "413",
      "product_status:recommended": "438",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53194",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53194.json",
      "version": "69"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:47:25.631Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53194\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:43:25.841090Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:43:27.711Z\"}}], \"cna\": {\"title\": \"PCI: Fix use-after-free of slot-\u003ebus on hot remove\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"50473dd3b2a08601a078f852ea05572de9b1f86c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"d0ddd2c92b75a19a37c887154223372b600fed37\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"da6e6ff1f6c57f16e07af955e0e997fc90dd1e75\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"41bbb1eb996be1435815aa1fbcc9ffc45b84cc12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"20502f0b3f3acd6bee300257556c27a867f80c8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"e5d5c04aac71bf1476dc44b56f2206a4c2facca8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"c8266ab8e7ccd1d1f5a9c8b29eb2020175048134\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"69d2ceac11acf8579d58d55c9c5b65fb658f916e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f46753c5e354b857b20ab8e0fe7b2579831dc369\", \"lessThan\": \"c7acef99642b763ba585f4a43af999fcdbcc3dc4\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/pci/slot.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.27\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.27\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.325\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.287\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.231\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.174\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/pci/slot.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/50473dd3b2a08601a078f852ea05572de9b1f86c\"}, {\"url\": \"https://git.kernel.org/stable/c/d0ddd2c92b75a19a37c887154223372b600fed37\"}, {\"url\": \"https://git.kernel.org/stable/c/da6e6ff1f6c57f16e07af955e0e997fc90dd1e75\"}, {\"url\": \"https://git.kernel.org/stable/c/41bbb1eb996be1435815aa1fbcc9ffc45b84cc12\"}, {\"url\": \"https://git.kernel.org/stable/c/20502f0b3f3acd6bee300257556c27a867f80c8b\"}, {\"url\": \"https://git.kernel.org/stable/c/e5d5c04aac71bf1476dc44b56f2206a4c2facca8\"}, {\"url\": \"https://git.kernel.org/stable/c/c8266ab8e7ccd1d1f5a9c8b29eb2020175048134\"}, {\"url\": \"https://git.kernel.org/stable/c/69d2ceac11acf8579d58d55c9c5b65fb658f916e\"}, {\"url\": \"https://git.kernel.org/stable/c/c7acef99642b763ba585f4a43af999fcdbcc3dc4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI: Fix use-after-free of slot-\u003ebus on hot remove\\n\\nDennis reports a boot crash on recent Lenovo laptops with a USB4 dock.\\n\\nSince commit 0fc70886569c (\\\"thunderbolt: Reset USB4 v2 host router\\\") and\\ncommit 59a54c5f3dbd (\\\"thunderbolt: Reset topology created by the boot\\nfirmware\\\"), USB4 v2 and v1 Host Routers are reset on probe of the\\nthunderbolt driver.\\n\\nThe reset clears the Presence Detect State and Data Link Layer Link Active\\nbits at the USB4 Host Router\u0027s Root Port and thus causes hot removal of the\\ndock.\\n\\nThe crash occurs when pciehp is unbound from one of the dock\u0027s Downstream\\nPorts:  pciehp creates a pci_slot on bind and destroys it on unbind.  The\\npci_slot contains a pointer to the pci_bus below the Downstream Port, but\\na reference on that pci_bus is never acquired.  The pci_bus is destroyed\\nbefore the pci_slot, so a use-after-free ensues when pci_slot_release()\\naccesses slot-\u003ebus.\\n\\nIn principle this should not happen because pci_stop_bus_device() unbinds\\npciehp (and therefore destroys the pci_slot) before the pci_bus is\\ndestroyed by pci_remove_bus_device().\\n\\nHowever the stacktrace provided by Dennis shows that pciehp is unbound from\\npci_remove_bus_device() instead of pci_stop_bus_device().  To understand\\nthe significance of this, one needs to know that the PCI core uses a two\\nstep process to remove a portion of the hierarchy:  It first unbinds all\\ndrivers in the sub-hierarchy in pci_stop_bus_device() and then actually\\nremoves the devices in pci_remove_bus_device().  There is no precaution to\\nprevent driver binding in-between pci_stop_bus_device() and\\npci_remove_bus_device().\\n\\nIn Dennis\u0027 case, it seems removal of the hierarchy by pciehp races with\\ndriver binding by pci_bus_add_devices().  pciehp is bound to the\\nDownstream Port after pci_stop_bus_device() has run, so it is unbound by\\npci_remove_bus_device() instead of pci_stop_bus_device().  Because the\\npci_bus has already been destroyed at that point, accesses to it result in\\na use-after-free.\\n\\nOne might conclude that driver binding needs to be prevented after\\npci_stop_bus_device() has run.  However it seems risky that pci_slot points\\nto pci_bus without holding a reference.  Solely relying on correct ordering\\nof driver unbind versus pci_bus destruction is certainly not defensive\\nprogramming.\\n\\nIf pci_slot has a need to access data in pci_bus, it ought to acquire a\\nreference.  Amend pci_create_slot() accordingly.  Dennis reports that the\\ncrash is not reproducible with this change.\\n\\nAbridged stacktrace:\\n\\n  pcieport 0000:00:07.0: PME: Signaling with IRQ 156\\n  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+\\n  pci_bus 0000:20: dev 00, created physical slot 12\\n  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present\\n  ...\\n  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0\\n  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1\\n  RIP: 0010:dev_driver_string+0x12/0x40\\n  pci_destroy_slot\\n  pciehp_remove\\n  pcie_port_remove_service\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  device_unregister\\n  remove_iter\\n  device_for_each_child\\n  pcie_portdrv_remove\\n  pci_device_remove\\n  device_release_driver_internal\\n  bus_remove_device\\n  device_del\\n  pci_remove_bus_device (recursive invocation)\\n  pci_remove_bus_device\\n  pciehp_unconfigure_device\\n  pciehp_disable_slot\\n  pciehp_handle_presence_or_link_change\\n  pciehp_ist\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.325\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.287\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.231\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.174\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.64\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.11\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"2.6.27\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"2.6.27\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-09-11T16:59:20.646Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53194\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T20:47:25.631Z\", \"dateReserved\": \"2024-11-19T17:17:25.014Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T13:49:36.534Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.