CVE-2024-26998 (GCVE-0-2024-26998)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:28 – Updated: 2025-11-04 17:16
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 434beb66368d4fb4d3119c2116b9398500adbf47 , < 7ae7104d54342433a3a73975f6569beefdd86350 (git)
Affected: 43066e32227ecde674e8ae1fcdd4a1ede67680c2 , < bb1118905e875c111d7ccef9aee86ac5e4e7f985 (git)
Affected: 43066e32227ecde674e8ae1fcdd4a1ede67680c2 , < 9cf7ea2eeb745213dc2a04103e426b960e807940 (git)
Affected: a629a9b2f7699314a4abe8fbc37b0ee667b60f33 (git)
Create a notification for this product.
    Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.6.29 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T18:39:13.227309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:46.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:16:05.094Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ae7104d54342433a3a73975f6569beefdd86350",
              "status": "affected",
              "version": "434beb66368d4fb4d3119c2116b9398500adbf47",
              "versionType": "git"
            },
            {
              "lessThan": "bb1118905e875c111d7ccef9aee86ac5e4e7f985",
              "status": "affected",
              "version": "43066e32227ecde674e8ae1fcdd4a1ede67680c2",
              "versionType": "git"
            },
            {
              "lessThan": "9cf7ea2eeb745213dc2a04103e426b960e807940",
              "status": "affected",
              "version": "43066e32227ecde674e8ae1fcdd4a1ede67680c2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a629a9b2f7699314a4abe8fbc37b0ee667b60f33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: Clearing the circular buffer before NULLifying it\n\nThe circular buffer is NULLified in uart_tty_port_shutdown()\nunder the spin lock. However, the PM or other timer based callbacks\nmay still trigger after this event without knowning that buffer pointer\nis not valid. Since the serial code is a bit inconsistent in checking\nthe buffer state (some rely on the head-tail positions, some on the\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\nThis will prevent asynchronous calls to dereference NULL pointer as\nreported recently in 8250 case:\n\n  BUG: kernel NULL pointer dereference, address: 00000cf5\n  Workqueue: pm pm_runtime_work\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  ...\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\n  __rpm_callback (drivers/base/power/runtime.c:393)\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\n  rpm_suspend (drivers/base/power/runtime.c:447)\n\nThe proposed change will prevent -\u003estart_tx() to be called during\nsuspend on shut down port."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:55:19.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
        }
      ],
      "title": "serial: core: Clearing the circular buffer before NULLifying it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26998",
    "datePublished": "2024-05-01T05:28:25.905Z",
    "dateReserved": "2024-02-19T14:20:24.206Z",
    "dateUpdated": "2025-11-04T17:16:05.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6.24\", \"versionEndExcluding\": \"6.6.29\", \"matchCriteriaId\": \"F9EBAA35-C267-42BF-9547-DE4832721766\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7.12\", \"versionEndExcluding\": \"6.8\", \"matchCriteriaId\": \"D6A2C3EC-DA7B-4144-8BAF-2DBB7E8CE4C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.8.8\", \"matchCriteriaId\": \"A6B3F478-AAC3-4675-897F-870080589B51\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: core: Clearing the circular buffer before NULLifying it\\n\\nThe circular buffer is NULLified in uart_tty_port_shutdown()\\nunder the spin lock. However, the PM or other timer based callbacks\\nmay still trigger after this event without knowning that buffer pointer\\nis not valid. Since the serial code is a bit inconsistent in checking\\nthe buffer state (some rely on the head-tail positions, some on the\\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\\nThis will prevent asynchronous calls to dereference NULL pointer as\\nreported recently in 8250 case:\\n\\n  BUG: kernel NULL pointer dereference, address: 00000cf5\\n  Workqueue: pm pm_runtime_work\\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  ...\\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\\n  __rpm_callback (drivers/base/power/runtime.c:393)\\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\\n  rpm_suspend (drivers/base/power/runtime.c:447)\\n\\nThe proposed change will prevent -\u003estart_tx() to be called during\\nsuspend on shut down port.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: core: borrando el b\\u00fafer circular antes de anularlo. El b\\u00fafer circular se anula en uart_tty_port_shutdown() bajo el bloqueo de giro. Sin embargo, el PM u otras devoluciones de llamada basadas en temporizadores a\\u00fan pueden activarse despu\\u00e9s de este evento sin saber que el puntero del b\\u00fafer no es v\\u00e1lido. Dado que el c\\u00f3digo de serie es un poco inconsistente al verificar el estado del b\\u00fafer (algunos se basan en las posiciones de cabecera y cola, otros en el puntero del b\\u00fafer), es mejor tener ambos alineados, es decir, que el puntero del b\\u00fafer sea NULL y las posiciones de cabecera y cola sean lo mismo, lo que significa que est\\u00e1 vac\\u00edo. Esto evitar\\u00e1 llamadas asincr\\u00f3nicas para desreferenciar el puntero NULL como se inform\\u00f3 recientemente en el caso 8250: ERROR: desreferencia del puntero NULL del kernel, direcci\\u00f3n: 00000cf5 Cola de trabajo: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809). . serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend ( incluir/linux/serial_core.h:667 controladores/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393)? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) El cambio propuesto evitar\\u00e1 que se llame a -\u0026gt;start_tx() durante la suspensi\\u00f3n al cerrar el puerto.\"}]",
      "id": "CVE-2024-26998",
      "lastModified": "2024-12-23T19:50:05.873",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-01T06:15:17.780",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26998\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:17.780\",\"lastModified\":\"2025-11-04T18:16:08.870\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: core: Clearing the circular buffer before NULLifying it\\n\\nThe circular buffer is NULLified in uart_tty_port_shutdown()\\nunder the spin lock. However, the PM or other timer based callbacks\\nmay still trigger after this event without knowning that buffer pointer\\nis not valid. Since the serial code is a bit inconsistent in checking\\nthe buffer state (some rely on the head-tail positions, some on the\\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\\nThis will prevent asynchronous calls to dereference NULL pointer as\\nreported recently in 8250 case:\\n\\n  BUG: kernel NULL pointer dereference, address: 00000cf5\\n  Workqueue: pm pm_runtime_work\\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  ...\\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\\n  __rpm_callback (drivers/base/power/runtime.c:393)\\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\\n  rpm_suspend (drivers/base/power/runtime.c:447)\\n\\nThe proposed change will prevent -\u003estart_tx() to be called during\\nsuspend on shut down port.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: serial: core: borrando el b\u00fafer circular antes de anularlo. El b\u00fafer circular se anula en uart_tty_port_shutdown() bajo el bloqueo de giro. Sin embargo, el PM u otras devoluciones de llamada basadas en temporizadores a\u00fan pueden activarse despu\u00e9s de este evento sin saber que el puntero del b\u00fafer no es v\u00e1lido. Dado que el c\u00f3digo de serie es un poco inconsistente al verificar el estado del b\u00fafer (algunos se basan en las posiciones de cabecera y cola, otros en el puntero del b\u00fafer), es mejor tener ambos alineados, es decir, que el puntero del b\u00fafer sea NULL y las posiciones de cabecera y cola sean lo mismo, lo que significa que est\u00e1 vac\u00edo. Esto evitar\u00e1 llamadas asincr\u00f3nicas para desreferenciar el puntero NULL como se inform\u00f3 recientemente en el caso 8250: ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 00000cf5 Cola de trabajo: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809). . serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend ( incluir/linux/serial_core.h:667 controladores/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393)? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) El cambio propuesto evitar\u00e1 que se llame a -\u0026gt;start_tx() durante la suspensi\u00f3n al cerrar el puerto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.24\",\"versionEndExcluding\":\"6.6.29\",\"matchCriteriaId\":\"F9EBAA35-C267-42BF-9547-DE4832721766\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.12\",\"versionEndExcluding\":\"6.8\",\"matchCriteriaId\":\"D6A2C3EC-DA7B-4144-8BAF-2DBB7E8CE4C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.8\",\"matchCriteriaId\":\"A6B3F478-AAC3-4675-897F-870080589B51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.918Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26998\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-09T18:39:13.227309Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:43.841Z\"}}], \"cna\": {\"title\": \"serial: core: Clearing the circular buffer before NULLifying it\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"434beb66368d4fb4d3119c2116b9398500adbf47\", \"lessThan\": \"7ae7104d54342433a3a73975f6569beefdd86350\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43066e32227ecde674e8ae1fcdd4a1ede67680c2\", \"lessThan\": \"bb1118905e875c111d7ccef9aee86ac5e4e7f985\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43066e32227ecde674e8ae1fcdd4a1ede67680c2\", \"lessThan\": \"9cf7ea2eeb745213dc2a04103e426b960e807940\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a629a9b2f7699314a4abe8fbc37b0ee667b60f33\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/tty/serial/serial_core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/tty/serial/serial_core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\"}, {\"url\": \"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\"}, {\"url\": \"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: core: Clearing the circular buffer before NULLifying it\\n\\nThe circular buffer is NULLified in uart_tty_port_shutdown()\\nunder the spin lock. However, the PM or other timer based callbacks\\nmay still trigger after this event without knowning that buffer pointer\\nis not valid. Since the serial code is a bit inconsistent in checking\\nthe buffer state (some rely on the head-tail positions, some on the\\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\\nThis will prevent asynchronous calls to dereference NULL pointer as\\nreported recently in 8250 case:\\n\\n  BUG: kernel NULL pointer dereference, address: 00000cf5\\n  Workqueue: pm pm_runtime_work\\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  ...\\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\\n  __rpm_callback (drivers/base/power/runtime.c:393)\\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\\n  rpm_suspend (drivers/base/power/runtime.c:447)\\n\\nThe proposed change will prevent -\u003estart_tx() to be called during\\nsuspend on shut down port.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"6.6.24\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.7.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T12:55:19.522Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26998\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T12:55:19.522Z\", \"dateReserved\": \"2024-02-19T14:20:24.206Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:28:25.905Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.