Log in Start free

Vulnerability · Published May 1, 2024 · Assigned by Linux

CVE-2024-26998serial: core: Clearing the circular buffer before NULLifying it

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 86.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.8.9-1DEBIAN-CVE-2024-26998
Debian:14linux6.8.9-1DEBIAN-CVE-2024-26998
Ubuntu:24.04:LTSlinux6.8.0-38.38USN-6893-1
Ubuntu:24.04:LTSlinux6.8.0-38.38UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-aws6.8.0-1011.12UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-aws6.8.0-1011.12USN-6893-3
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1011.12~22.04.1UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-azure6.8.0-1010.10UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-azure6.8.0-1010.10USN-6893-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-gcp6.8.0-1010.11USN-6893-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1010.11UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-gke6.8.0-1006.9UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-gke6.8.0-1006.9USN-6893-2
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-ibm6.8.0-1008.8USN-6893-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1008.8UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-intel6.8.0-1007.14UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-intel6.8.0-1007.14USN-6893-1
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-38.38.1UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-38.38.1USN-6893-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1009.9UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1009.9USN-6893-2
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1009.9~22.04.1UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1008.8USN-6893-1
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1008.8UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-oracle6.8.0-1008.8USN-6918-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1008.8UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1008.8~22.04.1UBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-raspi6.8.0-1007.7USN-6893-1
Ubuntu:24.04:LTSlinux-raspi6.8.0-1007.7UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-26998
Ubuntu:24.04:LTSlinux-riscv6.8.0-38.38.1UBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-26998
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-26998

Affected products (as reported)

VendorProductVersions
Linux Linux 434beb66368d4fb4d3119c2116b9398500adbf47 – before 7ae7104d54342433a3a73975f6569beefdd8635043066e32227ecde674e8ae1fcdd4a1ede67680c2 – before bb1118905e875c111d7ccef9aee86ac5e4e7f98543066e32227ecde674e8ae1fcdd4a1ede67680c2 – before 9cf7ea2eeb745213dc2a04103e426b960e807940a629a9b2f7699314a4abe8fbc37b0ee667b60f336.6.24 – before 6.6.296.7.12 – before 6.8
Linux Linux 6.8

References