CVE-2024-38627: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-38627 is a vulnerability discovered in the Linux kernel's stm class that involves a double free issue in the stm_register_device() function. The vulnerability was disclosed on June 21, 2024, affecting multiple versions of the Linux kernel from version 4.7 up to versions before 4.19.316, 5.4.278, 5.10.219, and 5.15.161 (NVD).

The vulnerability occurs when the put_device(&stm->dev) call triggers stm_device_release() which frees the 'stm' memory, followed by a vfree(stm) call on the next line, resulting in a double free condition. This issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with potential for high impact on confidentiality, integrity, and availability (NVD).

The double free vulnerability could potentially lead to memory corruption and system instability. Given the CVSS score and vector, successful exploitation could result in high impacts on system confidentiality, integrity, and availability, though local access is required (NVD).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No evidence of active exploitation in the wild has been reported at the time of assessment (NVD).

The vulnerability has been patched in various Linux kernel versions. Fixed versions include 4.19.316, 5.4.278, 5.10.219, and 5.15.161. Multiple Linux distributions have released updates to address this vulnerability, including Ubuntu and Debian. Users are advised to update to the patched kernel versions (Debian).