#VU90576 NULL pointer dereference in Linux kernel - CVE-2024-26855

Vulnerability identifier: #VU90576

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26855

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_bridge_setlink() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/d9fefc51133107e59d192d773be86c1150cfeebb
https://git.kernel.org/stable/c/37fe99016b12d32100ce670216816dba6c48b309
https://git.kernel.org/stable/c/8d95465d9a424200485792858c5b3be54658ce19
https://git.kernel.org/stable/c/afdd29726a6de4ba27cd15590661424c888dc596
https://git.kernel.org/stable/c/1a770927dc1d642b22417c3e668c871689fc58b3
https://git.kernel.org/stable/c/0e296067ae0d74a10b4933601f9aa9f0ec8f157f
https://git.kernel.org/stable/c/06e456a05d669ca30b224b8ed962421770c1496c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.