What is the severity of CVE-2024-50238?

CVE-2024-50238 has a medium severity rating due to the potential for a NULL dereference that can occur during runtime suspension.

How do I fix CVE-2024-50238?

To fix CVE-2024-50238, update your Linux kernel to at least version 6.12.15-1 or apply the appropriate patches from your distribution.

What versions of the Linux Kernel are affected by CVE-2024-50238?

CVE-2024-50238 affects Linux Kernel versions between 6.8.2 and 6.11.7, as well as various 6.12 release candidates.

Is CVE-2024-50238 an easily exploitable vulnerability?

CVE-2024-50238 is not classified as easily exploitable, but it can lead to system instability if an attack is successful.

What are the consequences of CVE-2024-50238 if left unpatched?

If CVE-2024-50238 is left unpatched, it can result in denial of service due to NULL pointer dereferences during runtime operations.

Vulnerability/
CVE-2024-50238

medium

5.5

CWE

476

9/11/2024

19/12/2024

CVE-2024-50238: phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend

First published: Sat Nov 09 2024(Updated: )

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation") removed most users of the platform device driver data from the qcom-qmp-usb driver, but mistakenly also removed the initialisation despite the data still being used in the runtime PM callbacks. This bug was later reproduced when the driver was copied to create the qmp-usbc driver. Restore the driver data initialisation at probe to avoid a NULL-pointer dereference on runtime suspend. Apparently no one uses runtime PM, which currently needs to be enabled manually through sysfs, with these drivers.

Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Affected Software	Affected Version	How to fix
Linux Kernel	>=6.8.2<6.9
Linux Kernel	>=6.9<6.11.7
Linux Kernel	=6.12-rc1
Linux Kernel	=6.12-rc2
Linux Kernel	=6.12-rc3
Linux Kernel	=6.12-rc4
Linux Kernel	=6.12-rc5
debian/linux		5.10.223-1 5.10.226-1 6.1.123-1 6.1.128-1 6.12.12-1 6.12.15-1

Remedy

https://git.kernel.org/stable/c/34c21f94fa1e147a19b54b6adf0c93a623b70dd8

Remedy

https://git.kernel.org/stable/c/c7086dc0539b1b2b61c8c735186698bca4858246

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-50238?
CVE-2024-50238 has a medium severity rating due to the potential for a NULL dereference that can occur during runtime suspension.
How do I fix CVE-2024-50238?
To fix CVE-2024-50238, update your Linux kernel to at least version 6.12.15-1 or apply the appropriate patches from your distribution.
What versions of the Linux Kernel are affected by CVE-2024-50238?
CVE-2024-50238 affects Linux Kernel versions between 6.8.2 and 6.11.7, as well as various 6.12 release candidates.
Is CVE-2024-50238 an easily exploitable vulnerability?
CVE-2024-50238 is not classified as easily exploitable, but it can lead to system instability if an attack is successful.
What are the consequences of CVE-2024-50238 if left unpatched?
If CVE-2024-50238 is left unpatched, it can result in denial of service due to NULL pointer dereferences during runtime operations.

agent/title
agent/type
agent/first-publish-date
agent/author
agent/remedy
agent/weakness
agent/severity
collector/mitre-cve
source/MITRE
agent/last-modified-date
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/usn-cve
source/Ubuntu
collector/launchpad-cve
source/Launchpad
agent/source
agent/references
agent/softwarecombine
agent/tags
agent/description
agent/event
collector/security-tracker-debian
source/Debian
vendor/linux
canonical/linux kernel
version/linux kernel/6.8.2
version/linux kernel/6.9
version/linux kernel/6.12-rc1
version/linux kernel/6.12-rc2
version/linux kernel/6.12-rc3
version/linux kernel/6.12-rc4
version/linux kernel/6.12-rc5
package-manager/debian

Frequently Asked Questions

What is the severity of CVE-2024-50238?
CVE-2024-50238 has a medium severity rating due to the potential for a NULL dereference that can occur during runtime suspension.
How do I fix CVE-2024-50238?
To fix CVE-2024-50238, update your Linux kernel to at least version 6.12.15-1 or apply the appropriate patches from your distribution.
What versions of the Linux Kernel are affected by CVE-2024-50238?
CVE-2024-50238 affects Linux Kernel versions between 6.8.2 and 6.11.7, as well as various 6.12 release candidates.
Is CVE-2024-50238 an easily exploitable vulnerability?
CVE-2024-50238 is not classified as easily exploitable, but it can lead to system instability if an attack is successful.
What are the consequences of CVE-2024-50238 if left unpatched?
If CVE-2024-50238 is left unpatched, it can result in denial of service due to NULL pointer dereferences during runtime operations.

CVE-2024-50238: phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-50238?

How do I fix CVE-2024-50238?

What versions of the Linux Kernel are affected by CVE-2024-50238?

Is CVE-2024-50238 an easily exploitable vulnerability?

What are the consequences of CVE-2024-50238 if left unpatched?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2024-50238?

How do I fix CVE-2024-50238?

What versions of the Linux Kernel are affected by CVE-2024-50238?

Is CVE-2024-50238 an easily exploitable vulnerability?

What are the consequences of CVE-2024-50238 if left unpatched?