CVE-2024-26998 (GCVE-0-2024-26998)
Vulnerability from cvelistv5
Published
2024-05-01 05:28
Modified
2025-11-04 17:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callbacks may still trigger after this event without knowning that buffer pointer is not valid. Since the serial code is a bit inconsistent in checking the buffer state (some rely on the head-tail positions, some on the buffer pointer), it's better to have both aligned, i.e. buffer pointer to be NULL and head-tail possitions to be the same, meaning it's empty. This will prevent asynchronous calls to dereference NULL pointer as reported recently in 8250 case: BUG: kernel NULL pointer dereference, address: 00000cf5 Workqueue: pm pm_runtime_work EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) ... ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809) __start_tx (drivers/tty/serial/8250/8250_port.c:1551) serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654) serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63) __rpm_callback (drivers/base/power/runtime.c:393) ? serial_port_remove (drivers/tty/serial/serial_port.c:50) rpm_suspend (drivers/base/power/runtime.c:447) The proposed change will prevent ->start_tx() to be called during suspend on shut down port.
References
Impacted products
Vendor Product Version
Linux Linux Version: 434beb66368d4fb4d3119c2116b9398500adbf47
Version: 43066e32227ecde674e8ae1fcdd4a1ede67680c2
Version: 43066e32227ecde674e8ae1fcdd4a1ede67680c2
Version: a629a9b2f7699314a4abe8fbc37b0ee667b60f33
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T18:39:13.227309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:46.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:16:05.094Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ae7104d54342433a3a73975f6569beefdd86350",
              "status": "affected",
              "version": "434beb66368d4fb4d3119c2116b9398500adbf47",
              "versionType": "git"
            },
            {
              "lessThan": "bb1118905e875c111d7ccef9aee86ac5e4e7f985",
              "status": "affected",
              "version": "43066e32227ecde674e8ae1fcdd4a1ede67680c2",
              "versionType": "git"
            },
            {
              "lessThan": "9cf7ea2eeb745213dc2a04103e426b960e807940",
              "status": "affected",
              "version": "43066e32227ecde674e8ae1fcdd4a1ede67680c2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a629a9b2f7699314a4abe8fbc37b0ee667b60f33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/serial_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: Clearing the circular buffer before NULLifying it\n\nThe circular buffer is NULLified in uart_tty_port_shutdown()\nunder the spin lock. However, the PM or other timer based callbacks\nmay still trigger after this event without knowning that buffer pointer\nis not valid. Since the serial code is a bit inconsistent in checking\nthe buffer state (some rely on the head-tail positions, some on the\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\nThis will prevent asynchronous calls to dereference NULL pointer as\nreported recently in 8250 case:\n\n  BUG: kernel NULL pointer dereference, address: 00000cf5\n  Workqueue: pm pm_runtime_work\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  ...\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\n  __rpm_callback (drivers/base/power/runtime.c:393)\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\n  rpm_suspend (drivers/base/power/runtime.c:447)\n\nThe proposed change will prevent -\u003estart_tx() to be called during\nsuspend on shut down port."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:55:19.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940"
        }
      ],
      "title": "serial: core: Clearing the circular buffer before NULLifying it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26998",
    "datePublished": "2024-05-01T05:28:25.905Z",
    "dateReserved": "2024-02-19T14:20:24.206Z",
    "dateUpdated": "2025-11-04T17:16:05.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.918Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26998\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-09T18:39:13.227309Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-05T15:20:43.841Z\"}}], \"cna\": {\"title\": \"serial: core: Clearing the circular buffer before NULLifying it\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"434beb66368d4fb4d3119c2116b9398500adbf47\", \"lessThan\": \"7ae7104d54342433a3a73975f6569beefdd86350\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43066e32227ecde674e8ae1fcdd4a1ede67680c2\", \"lessThan\": \"bb1118905e875c111d7ccef9aee86ac5e4e7f985\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43066e32227ecde674e8ae1fcdd4a1ede67680c2\", \"lessThan\": \"9cf7ea2eeb745213dc2a04103e426b960e807940\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a629a9b2f7699314a4abe8fbc37b0ee667b60f33\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/tty/serial/serial_core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/tty/serial/serial_core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7ae7104d54342433a3a73975f6569beefdd86350\"}, {\"url\": \"https://git.kernel.org/stable/c/bb1118905e875c111d7ccef9aee86ac5e4e7f985\"}, {\"url\": \"https://git.kernel.org/stable/c/9cf7ea2eeb745213dc2a04103e426b960e807940\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: core: Clearing the circular buffer before NULLifying it\\n\\nThe circular buffer is NULLified in uart_tty_port_shutdown()\\nunder the spin lock. However, the PM or other timer based callbacks\\nmay still trigger after this event without knowning that buffer pointer\\nis not valid. Since the serial code is a bit inconsistent in checking\\nthe buffer state (some rely on the head-tail positions, some on the\\nbuffer pointer), it\u0027s better to have both aligned, i.e. buffer pointer\\nto be NULL and head-tail possitions to be the same, meaning it\u0027s empty.\\nThis will prevent asynchronous calls to dereference NULL pointer as\\nreported recently in 8250 case:\\n\\n  BUG: kernel NULL pointer dereference, address: 00000cf5\\n  Workqueue: pm pm_runtime_work\\n  EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  ...\\n  ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)\\n  __start_tx (drivers/tty/serial/8250/8250_port.c:1551)\\n  serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)\\n  serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)\\n  __rpm_callback (drivers/base/power/runtime.c:393)\\n  ? serial_port_remove (drivers/tty/serial/serial_port.c:50)\\n  rpm_suspend (drivers/base/power/runtime.c:447)\\n\\nThe proposed change will prevent -\u003estart_tx() to be called during\\nsuspend on shut down port.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"6.6.24\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.8\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.7.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T12:55:19.522Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26998\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T12:55:19.522Z\", \"dateReserved\": \"2024-02-19T14:20:24.206Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:28:25.905Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.