CVE-2024-33619 is a vulnerability in the Linux kernel's EFI libstub code where the pointer priv.runtime_map is freed without checking if it was allocated. Specifically, priv.runtime_map is only allocated when the efi_novamap flag is not set; otherwise, it remains uninitialized. The error path in the code frees priv.runtime_map unconditionally, which can cause freeing of an uninitialized pointer. The fix ensures that priv.runtime_map is only freed if it was actually allocated, preventing potential memory corruption or crashes. This defect was discovered and resolved using Coverity Static Analysis Security Testing (SAST).

The vulnerability can cause improper memory management leading to potential system instability or crashes (availability impact). There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity), reflecting a local attacker with low privileges potentially causing denial of service by triggering the improper free.

A fix for this vulnerability has been implemented in the Linux kernel source code. Users should update their Linux kernel to the latest patched version that includes this fix. Since no specific patch version is provided, check the official Linux kernel advisories or repositories for the commit addressing CVE-2024-33619 and apply the update accordingly.