PT-2024-21484 · Linux · Linux Kernel

Published 2024-04-03 · Updated 2024-12-19 · CVE-2024-26713

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.7.0-203405+

Description The Linux kernel has a vulnerability that causes a NULL pointer dereference when a PCI device is dynamically added. This occurs because the iommu device structure is not properly initialized during the DLPAR add process. The vulnerability is caused by a commit that added iommu ops to report capabilities and allow blocking domains, which broke the DLPAR add functionality.

Recommendations To resolve this issue, register the iommu device during DLPAR add as well. This can be done by calling the iommu device register() function during the DLPAR add process, ensuring that the iommu device structure is properly initialized.

Note: The provided information does not specify the exact versions that are vulnerable or the versions that contain the fix. However, based on the given data, it appears that Linux kernel version 6.7.0-203405+ is affected.

Related Identifiers

CVE-2024-26713

Affected Products

Linux Kernel

References · 10

• https://security-tracker.debian.org/tracker/CVE-2024-26713 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26713 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26713 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26713 · Security Note
• https://ubuntu.com/security/CVE-2024-26713 · Vendor Advisory
• https://git.kernel.org/stable/c/ed8b94f6e0acd652ce69bd69d678a0c769172df8 · Note
• https://git.kernel.org/stable/c/d4f762d6403f7419de90d7749fa83dd92ffb0e1d · Note
• https://git.kernel.org/linus/ed8b94f6e0acd652ce69bd69d678a0c769172df8 · Note
• https://git.kernel.org/stable/c/9978d5b744e0227afe19e3bcb4c5f75442dde753 · Note