Vulnerability identifier: #VU90559

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26978

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the max310x_i2c_slave_addr() function in drivers/tty/serial/max310x.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/7d271b798add90c6196539167c019d0817285cf0
http://git.kernel.org/stable/c/c45e53c27b78afd6c81fc25608003576f27b5735
http://git.kernel.org/stable/c/12609c76b755dbeb1645c0aacc0f0f4743b2eff3
http://git.kernel.org/stable/c/2160ad6861c4a21d3fa553d7b2aaec6634a37f8a
http://git.kernel.org/stable/c/5cd8af02b466e1beeae13e2de3dc58fcc7925e5a
http://git.kernel.org/stable/c/aeca49661fd02fd56fb026768b580ce301b45733
http://git.kernel.org/stable/c/0d27056c24efd3d63a03f3edfbcfc4827086b110

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.