{"cve":"CVE-2024-44967","nvd":{"published":"2024-09-04T19:15:31.117","modified":"2026-08-04T11:20:04.850","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mgag200: Bind I2C lifetime to DRM device\n\nManaged cleanup with devm_add_action_or_reset() will release the I2C\nadapter when the underlying Linux device goes away. But the connector\nstill refers to it, so this cleanup leaves behind a stale pointer\nin struct drm_connector.ddc.\n\nBind the lifetime of the I2C adapter to the connector's lifetime by\nusing DRM's managed release. When the DRM device goes away (after\nthe Linux device) DRM will first clean up the connector and then\nclean up the I2C adapter.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7c","https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17","https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191","https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:54:16.205165117+00:00"},"epss":{"cve":"CVE-2024-44967","score":0.00218,"percentile":0.12287,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}