CVE-2024-58003: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-58003 affects the Linux kernel's media subsystem, specifically the ds90ub9x3 driver components (ub913 and ub953). The vulnerability was discovered and disclosed in February 2025, impacting the firmware node handling in the driver's removal process (NVD).

The vulnerability stems from an improper cleanup process in the ds90ub9x3 drivers where fwnode_handle_put(priv->sd.fwnode) is called during the device removal process. If the driver is removed multiple times, this leads to a 'put overflow' condition. The issue originated from a leftover fwnode_handle_put() call that remained after changes made in commit 905f88ccebb1 ('media: i2c: ds90ub9x3: Fix sub-device matching') (Kernel Commit).

The vulnerability can potentially cause memory corruption or system crashes when the affected driver is removed multiple times, due to the improper handling of firmware node references (NVD).

The issue has been fixed by removing the redundant fwnode_handle_put() calls in both the ub913 and ub953 drivers. The fix has been implemented in the Linux kernel through a patch that removes these problematic calls (Kernel Commit).