CVE-2024-26714 interconnect: qcom: sc8180x: Mark CO0 BCM keepalive
A missing keepalive flag in the Qualcomm SC8180x interconnect driver causes system hangs and log spam, requiring a kernel patch to stabilize hardware connectivity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26714?
CVE-2024-26714 is a medium-severity denial of service vulnerability in Linux kernel, published on 3 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
interconnect: qcom: sc8180x: Mark CO0 BCM keepalive
The CO0 BCM needs to be up at all times, otherwise some hardware (like the UFS controller) loses its connection to the rest of the SoC, resulting in a hang of the platform, accompanied by a spectacular logspam.
Mark it as keepalive to prevent such cases.
Which versions are affected by CVE-2024-26714?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26714?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-26714 being exploited?
There is no known exploitation of CVE-2024-26714 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26714, DEBIAN-CVE-2024-26714, GHSA-vfrw-8352-324f, ROOT-OS-UBUNTU-2204-CVE-2024-26714, UBUNTU-CVE-2024-26714.