CVE-2024-47809
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
11/01/2025
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
dlm: fix possible lkb_resource null dereference<br />
<br />
This patch fixes a possible null pointer dereference when this function is<br />
called from request_lock() as lkb->lkb_resource is not assigned yet,<br />
only after validate_lock_args() by calling attach_lkb(). Another issue<br />
is that a resource name could be a non printable bytearray and we cannot<br />
assume to be ASCII coded.<br />
<br />
The log functionality is probably never being hit when DLM is used in<br />
normal way and no debug logging is enabled. The null pointer dereference<br />
can only occur on a new created lkb that does not have the resource<br />
assigned yet, it probably never hits the null pointer dereference but we<br />
should be sure that other changes might not change this behaviour and we<br />
actually can hit the mentioned null pointer dereference.<br />
<br />
In this patch we just drop the printout of the resource name, the lkb id<br />
is enough to make a possible connection to a resource name if this<br />
exists.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.66 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.5 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



