GHSA-q2h2-9xqm-xcc7

GHSA-q2h2-9xqm-xcc7 PUBLISHED CVSS 4.599999904632568 MEDIUM

Record from GitHub Advisory Database · Published February 2, 2023

The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.

Risk scores

CVSS 3.1

4.599999904632568

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Timeline

Feb 2, 2023 CVE Published
Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-q2h2-9xqm-xcc7
vulnetix vdb fixes GHSA-q2h2-9xqm-xcc7

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-q2h2-9xqm-xcc7/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16%40diag.uniroma1.it url
https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-1-9a5192dcef16@diag.uniroma1.it url
https://seclists.org/oss-sec/2023/q1/53 url
http://www.openwall.com/lists/oss-security/2023/11/05/1 url
https://nvd.nist.gov/vuln/detail/CVE-2023-25012 advisory
https://bugzilla.suse.com/show_bug.cgi?id=1207560 url
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27d2a2fd844ec7da70d19fabb482304fd1e0595b url
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76ca8da989c7d97a7f76c75d475fe95a584439d7 url
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 url
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html url
http://www.openwall.com/lists/oss-security/2023/02/02/1 url

Look up in the Resolve Platform →