CVE-2024-26751: ARM: ep93xx: Add terminator to gpiod_lookup_table
In the Linux kernel, the following vulnerability has been resolved:
ARM: ep93xx: Add terminator to gpiodlookuptable
Without the terminator, if a conid is passed to gpiofind() that does not exist in the lookup table the function will not stop looping correctly, and eventually cause an oops.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26751?
CVE-2024-26751 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-26751?
To fix CVE-2024-26751, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-26751?
CVE-2024-26751 affects specific versions of the Linux kernel used in Debian environments.
What is the cause of CVE-2024-26751?
CVE-2024-26751 is caused by the absence of a terminator in the gpiod_lookup_table, leading to infinite loops in gpio_find() when a non-existent con_id is queried.
Is there a workaround for CVE-2024-26751?
There are no known effective workarounds for CVE-2024-26751; updating to a patched kernel version is recommended.