CVE-2024-58054: Linux Kernel Use-After-Free Vulnerability

CVE-2024-58054 Overview

CVE-2024-58054 is a Linux kernel vulnerability in the staging: media: max96712 driver. Removing the max96712 module triggers a kernel oops caused by dereferencing an invalid pointer during subdevice unregistration. The issue stems from v4l2_i2c_subdev_init() overwriting the I2C client data with a pointer to the subdev structure instead of the driver private data. When max96712_remove() retrieves the client data and passes it to v4l2_async_unregister_subdev(), the kernel dereferences a corrupted pointer and crashes.

Critical Impact
A local user with module unload privileges can trigger a kernel paging fault, leading to a denial of service on affected systems running the vulnerable driver.

Affected Products

Linux kernel (upstream, multiple stable branches prior to the referenced fix commits)
Debian Linux 11 (bullseye)
Systems shipping the staging: media: max96712 GMSL2 deserializer driver

Discovery Timeline

2025-03-06 - CVE-2024-58054 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-58054

Vulnerability Analysis

The vulnerability is a kernel-mode null/invalid pointer dereference [CWE-476] in the Maxim max96712 GMSL2 deserializer staging driver. The driver stores its private data with i2c_set_clientdata() during probe, then calls v4l2_i2c_subdev_init(). The V4L2 helper internally invokes i2c_set_clientdata() a second time and overwrites the stored pointer, replacing the driver private context with a pointer to the v4l2_subdev structure.

When the module is unloaded, max96712_remove() calls i2c_get_clientdata() expecting the driver private pointer. Instead it receives the subdev pointer, then treats a member offset within it as a valid v4l2_async_subdev reference. The subsequent call chain reaches v4l2_subdev_put_privacy_led() and led_put(), which dereferences the address 0x00007375746174db and generates a level-0 translation fault (ESR = 0x0000000096000004).

Root Cause

The root cause is a lifecycle bug: v4l2_i2c_subdev_init() clobbers the I2C client data that the driver previously configured. The max96712 driver did not re-store its private pointer after the V4L2 initialization call, causing subsequent i2c_get_clientdata() retrievals to return the wrong object type.

Attack Vector

Exploitation is local and requires the ability to unload kernel modules, typically limited to root (CAP_SYS_MODULE). An attacker who can invoke rmmod max96712 on a system where the driver has bound to a max96712 I2C device triggers the oops. The result is a kernel crash rather than code execution. On systems configured with panic_on_oops, the crash cascades into a full kernel panic.

No verified public exploit code is available. The trigger is described directly in the upstream kernel commit message and reproduces by unloading the driver after normal probe.

Detection Methods for CVE-2024-58054

Indicators of Compromise

Kernel oops entries in dmesg or journalctl -k referencing led_put, v4l2_subdev_put_privacy_led, or max96712_remove in the call trace
Unable to handle kernel paging request faults immediately following rmmod max96712 events
Taint flag G C (crap/staging module loaded) combined with a preceding module unload of max96712

Detection Strategies

Inventory hosts running kernels earlier than the versions containing fix commits 1556b914, 278a98f6, 3311c539, dfde3d63, and ee1b5046
Correlate audit records (auditd, SYSCALL with delete_module) targeting max96712 with subsequent kernel error messages
Alert on kernel ring buffer messages matching the fault signature at led_put+0x1c/0x40 on ARM64 embedded platforms

Monitoring Recommendations

Forward /dev/kmsg and kernel journal entries to a centralized log platform and create rules for kernel oops signatures
Monitor use of init_module, finit_module, and delete_module syscalls on production Linux systems, especially those with automotive or camera-serializer hardware
Track package updates for linux-image-* on Debian systems to confirm the fix from the Debian LTS advisory is applied

How to Mitigate CVE-2024-58054

Immediate Actions Required

Apply the stable kernel updates that include the upstream fix commits referenced by kernel.org
On Debian 11 systems, install the kernel update announced in the Debian LTS Announcement
Restrict CAP_SYS_MODULE and module unload capability to trusted administrators only
Reboot after patching to unload any in-memory copies of the vulnerable driver

Patch Information

The upstream fix restores the driver's private pointer with i2c_set_clientdata() after v4l2_i2c_subdev_init() returns, ensuring max96712_remove() receives the correct context. Fixes are available in the kernel commits 1556b914, 278a98f6, 3311c539, dfde3d63, and ee1b5046.

Workarounds

Blacklist the max96712 module on systems that do not require GMSL2 deserializer functionality by adding blacklist max96712 to /etc/modprobe.d/
Avoid unloading the max96712 driver at runtime on unpatched systems; leave it resident until reboot
Disable CONFIG_VIDEO_MAX96712 when building custom kernels for hardware that does not use this deserializer

bash

# Configuration example: prevent loading the vulnerable driver until patched
echo 'blacklist max96712' | sudo tee /etc/modprobe.d/cve-2024-58054.conf
sudo depmod -a
sudo update-initramfs -u