CVE-2024-47809

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
11/01/2025
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dlm: fix possible lkb_resource null dereference<br /> <br /> This patch fixes a possible null pointer dereference when this function is<br /> called from request_lock() as lkb-&gt;lkb_resource is not assigned yet,<br /> only after validate_lock_args() by calling attach_lkb(). Another issue<br /> is that a resource name could be a non printable bytearray and we cannot<br /> assume to be ASCII coded.<br /> <br /> The log functionality is probably never being hit when DLM is used in<br /> normal way and no debug logging is enabled. The null pointer dereference<br /> can only occur on a new created lkb that does not have the resource<br /> assigned yet, it probably never hits the null pointer dereference but we<br /> should be sure that other changes might not change this behaviour and we<br /> actually can hit the mentioned null pointer dereference.<br /> <br /> In this patch we just drop the printout of the resource name, the lkb id<br /> is enough to make a possible connection to a resource name if this<br /> exists.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.6.66 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.5 (excluding)