CVE-2024-26968: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved:
clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcomfindfreq() or qcomfindfreqfloor().
Only compile tested.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Ensure the gcc-ipq9574 frequency table arrays are terminated with an empty element to prevent possible out-of-bound access when traversed by qcom_find_freq() / qcom_find_freq_floor().
Linux kernel clk: qcom gcc-ipq9574 frequency table arrays Frequency table array termination = Terminated with an empty element
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26968?
CVE-2024-26968 is classified with a severity that could lead to improper handling of frequency table arrays in the Linux kernel.
How do I fix CVE-2024-26968?
To fix CVE-2024-26968, ensure that the frequency table arrays are properly terminated with an empty element in your Linux kernel version.
Which Linux kernel versions are affected by CVE-2024-26968?
CVE-2024-26968 affects Linux kernel versions from 6.4 up to 6.6.24, 6.7, and 6.8 up to 6.8.3.
What specific Linux distributions are impacted by CVE-2024-26968?
Debian versions including linux 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, and 6.12.10-1, 6.12.11-1 are impacted by CVE-2024-26968.
Are there any available patches for CVE-2024-26968?
Yes, patches are available for CVE-2024-26968 in the official Linux kernel repositories and through Debian updates.