#VU90784 Improper locking in Linux kernel - CVE-2024-26790

Vulnerability identifier: #VU90784

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26790

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the FSL_QDMA_CMD_PF BIT() and fsl_qdma_comp_fill_memcpy() functions in drivers/dma/fsl-qdma.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/518d78b4fac68cac29a263554d7f3b19da99d0da
https://git.kernel.org/stable/c/bb3a06e9b9a30e33d96aadc0e077be095a4f8580
https://git.kernel.org/stable/c/106c1ac953a66556ec77456c46e818208d3a9bce
https://git.kernel.org/stable/c/237ecf1afe6c22534fa43abdf2bf0b0f52de0aaa
https://git.kernel.org/stable/c/5b696e9c388251f1c7373be92293769a489fd367
https://git.kernel.org/stable/c/ad2f8920c314e0a2d9e984fc94b729eca3cda471
https://git.kernel.org/stable/c/9d739bccf261dd93ec1babf82f5c5d71dd4caa3e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.