CVE-2024-27043

In the Linux kernel, the following vulnerability has been resolved:

media: edia: dvbdev: fix a use-after-free

In dvbregisterdevice, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain:

budgetregister |-> dvbdmxdevinit |-> dvbregisterdevice |-> dvbdmxdevrelease |-> dvbunregisterdevice |-> dvbremovedevice |-> dvbdeviceput |-> krefput

When calling dvbunregisterdevice, dmxdev->dvbdev (i.e. *pdvbdev in dvbregisterdevice) could point to memory that had been freed in dvbregisterdevice. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free.