Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
AV AC PR UI S C I A CVSS EPSS %ile KEV
L H L N U H H H 7.0 .0023 14.2 —
AFFECTED
Product Versions Fixed
Linux 87e0f28eda36c7843523aa8dd0c5dab3331e9718 – —
Linux 6.4 – 6.6.55
TIMELINE
Oct 21 Reserved by Linux
Oct 21 Published (CNA: Linux)
Aug 4 RESCORED — CVE-2024-49874 (Linux). CVSS 7.8 → 7 (NVD).
Description
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
In the svc_i3c_master_probe function, &master->hj_work is bound with
svc_i3c_master_hj_work, &master->ibi_work is bound with
svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work can start the
hj_work, svc_i3c_master_irq_handler can start the ibi_work.
If we remove the module which will call svc_i3c_master_remove to
make cleanup, it will free master->base through i3c_master_unregister
while the work mentioned above will be used. The sequence of operations
that may lead to a UAF bug is as follows:
CPU0 CPU1
| svc_i3c_master_hj_work
svc_i3c_master_remove |
i3c_master_unregister(&master->base)|
device_unregister(&master->dev) |
device_release |
//free master->base |
| i3c_master_do_daa(&master->base)
| //use master->base
Fix it by ensuring that the work is canceled before proceeding with the
cleanup in svc_i3c_master_remove.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 21, 2024 | Reserved | Reserved by Linux |
| October 21, 2024 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-49874 (Linux). CVSS 7.8 → 7 (NVD). |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 87e0f28eda36c7843523aa8dd0c5dab3331e9718 | — |
| Linux | Linux | — | 6.4 | 6.6.55 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-49874 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.