CVE-2024-26942: net: phy: qcom: at803x: fix kernel panic with at8031_probe
In the Linux kernel, the following vulnerability has been resolved:
net: phy: qcom: at803x: fix kernel panic with at8031probe
On reworking and splitting the at803x driver, in splitting function of at803x PHYs it was added a NULL dereference bug where priv is referenced before it's actually allocated and then is tried to write to for the is1000basex and isfiber variables in the case of at8031, writing on the wrong address.
Fix this by correctly setting priv local variable only after at803xprobe is called and actually allocates priv in the phydev struct.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26942?
CVE-2024-26942 has been classified with a severity that indicates it could cause kernel panic due to a NULL dereference.
How do I fix CVE-2024-26942?
To mitigate CVE-2024-26942, update to a patched version of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which versions of the Linux kernel are affected by CVE-2024-26942?
CVE-2024-26942 affects Linux kernel versions between 6.0 and 6.8.3 as well as 6.9-rc1.
What is the impact of CVE-2024-26942?
The impact of CVE-2024-26942 can lead to system instability and crashes due to the kernel panic issue.
Is CVE-2024-26942 specific to any distributions?
CVE-2024-26942 impacts the general Linux kernel, but specific package versions in distributions like Debian must be addressed for a fix.