CVE-2024-26942 net: phy: qcom: at803x: fix kernel panic with at8031_probe
A null pointer dereference in the Qualcomm AT803x PHY driver causes a kernel panic, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26942?
CVE-2024-26942 is a medium-severity vulnerability in Linux kernel, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: phy: qcom: at803x: fix kernel panic with at8031_probe
On reworking and splitting the at803x driver, in splitting function of at803x PHYs it was added a NULL dereference bug where priv is referenced before it's actually allocated and then is tried to write to for the is_1000basex and is_fiber variables in the case of at8031, writing on the wrong address.
Fix this by correctly setting priv local variable only after at803x_probe is called and actually allocates priv in the phydev struct.
Which versions are affected by CVE-2024-26942?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26942?
Apply the vendor's patch.
Is CVE-2024-26942 being exploited?
There is no known exploitation of CVE-2024-26942 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26942, DEBIAN-CVE-2024-26942, GHSA-j563-gw8p-23mq, UBUNTU-CVE-2024-26942.