PT-2024-29265 · Linux+6 · Linux Kernel+6
Niklas Cassel
·
Published
2024-06-29
·
Updated
2025-09-29
·
CVE-2024-41098
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.10.0-rc5
Description
A null pointer dereference vulnerability has been resolved in the Linux kernel. The issue occurs when the
ata port alloc() call in ata host alloc() fails, causing ata host release() to be called. However, the code in ata host release() tries to free ata port struct members unconditionally, leading to a page fault error. This can result in a system crash or potentially allow an attacker to execute arbitrary code.Recommendations
To resolve this issue, update the Linux kernel to a version later than 6.10.0-rc5.
As a temporary workaround, consider disabling the
ata host release() function until a patch is available.
Restrict access to the libata module to minimize the risk of exploitation.
Avoid using the ata port alloc() and ata host alloc() functions in combination until the issue is resolved.
Apply configuration changes to prevent the ata host release() function from being called unnecessarily.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu