CVE-2024-26858
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
17/04/2024
Last modified:
03/03/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map<br />
<br />
Just simply reordering the functions mlx5e_ptp_metadata_map_put and<br />
mlx5e_ptpsq_track_metadata in the mlx5e_txwqe_complete context is not good<br />
enough since both the compiler and CPU are free to reorder these two<br />
functions. If reordering does occur, the issue that was supposedly fixed by<br />
7e3f3ba97e6c ("net/mlx5e: Track xmit submission to PTP WQ after populating<br />
metadata map") will be seen. This will lead to NULL pointer dereferences in<br />
mlx5e_ptpsq_mark_ts_cqes_undelivered in the NAPI polling context due to the<br />
tracking list being populated before the metadata map.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.5.13 (including) | 6.6 (excluding) |
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.3 (including) | 6.6.22 (excluding) |
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.7.10 (excluding) |
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e
- https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a
- https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549
- https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e
- https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a
- https://git.kernel.org/stable/c/d1f71615dbb305f14f3b756cce015d70d8667549