CVE-2024-26942

CVSS v3.1 5.5 (Medium)
55% Progress
EPSS 0.04 % (10th)
0.04% Progress
Affected Products 1
Advisories 5
NVD Status Modified

In the Linux kernel, the following vulnerability has been resolved:

net: phy: qcom: at803x: fix kernel panic with at8031_probe

On reworking and splitting the at803x driver, in splitting function of
at803x PHYs it was added a NULL dereference bug where priv is referenced
before it's actually allocated and then is tried to write to for the
is_1000basex and is_fiber variables in the case of at8031, writing on
the wrong address.

Fix this by correctly setting priv local variable only after
at803x_probe is called and actually allocates priv in the phydev struct.

Weaknesses
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-476
NULL Pointer Dereference
CVE Status
PUBLISHED
NVD Status
Modified
CNA
kernel.org
Published Date
2024-05-01 06:15:09
(4 months ago)
Updated Date
2024-07-03 01:50:04
(2 months ago)

Affected Products

Loading...
Loading...
Loading...

Configuration #1

    CPE23 From Up To
  Linux Kernel above 6.8 version and prior 6.8.3 version cpe:2.3:o:linux:linux_kernel > 6.8 < 6.8.3
  Linux Kernel 6.9 Rc1 cpe:2.3:o:linux:linux_kernel:6.9:rc1
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...