CVE-2024-26966 (GCVE-0-2024-26966)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:19 – Updated: 2026-08-05 11:28
VLAI
Title
clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
Summary
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < 5533686e99b04994d7c4877dc0e4282adc9444a2 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < b2dfb216f32627c2f6a8041f2d9d56d102ab87c0 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < a09aecb6cb482de88301c43bf00a6c8726c4d34f (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < 3aedcf3755c74dafc187eb76acb04e3e6348b1a9 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < 185de0b7cdeaad8b89ebd4c8a258ff2f21adba99 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < 9b4c4546dd61950e80ffdca1bf6925f42b665b03 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < 7e5432401536117c316d7f3b21d46b64c1514f38 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < 5638330150db2cc30b53eed04e481062faa3ece8 (git)
Affected: 2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd , < a903cfd38d8dee7e754fb89fd1bebed99e28003d (git)
Create a notification for this product.
Linux Linux Affected: 3.17
Unaffected: 0 , < 3.17 (semver)
Unaffected: 4.19.312 , ≤ 4.19.* (semver)
Unaffected: 5.4.274 , ≤ 5.4.* (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.84 , ≤ 6.1.* (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.707Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26966",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:45:23.145806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:47.058Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/qcom/mmcc-apq8084.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5533686e99b04994d7c4877dc0e4282adc9444a2",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "b2dfb216f32627c2f6a8041f2d9d56d102ab87c0",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "a09aecb6cb482de88301c43bf00a6c8726c4d34f",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "3aedcf3755c74dafc187eb76acb04e3e6348b1a9",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "185de0b7cdeaad8b89ebd4c8a258ff2f21adba99",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "9b4c4546dd61950e80ffdca1bf6925f42b665b03",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "7e5432401536117c316d7f3b21d46b64c1514f38",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "5638330150db2cc30b53eed04e481062faa3ece8",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            },
            {
              "lessThan": "a903cfd38d8dee7e754fb89fd1bebed99e28003d",
              "status": "affected",
              "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/qcom/mmcc-apq8084.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a SoC clock-controller driver reached only through local interfaces \u2014 V4L2/DRM device nodes whose format and mode requests propagate into clk_set_rate/clk_round_rate, or debugfs. There is no network-facing path to qcom_find_freq().\nAC:L - The overrun is deterministic: any rate request exceeding the last table entry (466.8 MHz / 320 MHz) walks past the array end every time, with no race to win and no attacker-uncontrollable state. The adjacent .data layout is fixed at build time, so an attacker targeting a known device knows exactly what is read.\nPR:L - An unprivileged local user with access to the camera or display device nodes (routinely granted to normal apps via the media/graphics groups on Android and embedded builds) can drive a rate request into the affected RCGs through the CLK_SET_RATE_PARENT branch clocks. No root or init-namespace capability is required.\nUI:N - The rate request is issued synchronously from the attacker\u0027s own ioctl on a device node; no victim action, mount, or file-open by another user is needed.\nS:U - The out-of-bounds read, the disclosed data, and the misprogrammed clock registers all remain within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The traversal reads an unbounded number of out-of-bounds words from kernel .data, and the value read is returned to the caller as req-\u003erate = f-\u003efreq, observable from userspace via clk_round_rate results and debugfs clk_rate. The adjacent memory is the struct clk_rcg2 containing parent_map, freq_tbl, and clkr.hw.init pointers, so kernel pointer values can be disclosed.\nI:H - The bogus out-of-bounds entry\u0027s src/pre_div/m/n fields are fed to __clk_rcg2_configure_mnd() and written into the RCG control registers, letting the attacker drive the MMSS AXI and OCMEM NoC bus clocks to an unvalidated, out-of-spec configuration that no code path was ever meant to produce.\nA:H - The loop has no upper bound and can walk off the end of the mapped section, and on the CLK_SET_RATE_PARENT path a garbage entry with n != 0 and m == 0 hits do_div(tmp, f-\u003em), a kernel divide-by-zero oops. Even short of that, programming an out-of-spec rate on the multimedia AXI/NoC bus clock hangs the multimedia subsystem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:41.926Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38"
        },
        {
          "url": "https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d"
        }
      ],
      "title": "clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26966",
    "datePublished": "2024-05-01T05:19:36.656Z",
    "dateReserved": "2024-02-19T14:20:24.201Z",
    "dateUpdated": "2026-08-05T11:28:41.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26966",
      "date": "2026-08-09",
      "epss": "0.00261",
      "percentile": "0.17642"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.17\", \"versionEndExcluding\": \"4.19.312\", \"matchCriteriaId\": \"9DAC0B62-D0D6-4AE8-BF57-20A912AADE19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.274\", \"matchCriteriaId\": \"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.215\", \"matchCriteriaId\": \"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.154\", \"matchCriteriaId\": \"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.84\", \"matchCriteriaId\": \"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.24\", \"matchCriteriaId\": \"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.12\", \"matchCriteriaId\": \"6BE9771A-BAFD-4624-95F9-58D536540C53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.8.3\", \"matchCriteriaId\": \"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\\n\\nThe frequency table arrays are supposed to be terminated with an\\nempty element. Add such entry to the end of the arrays where it\\nis missing in order to avoid possible out-of-bound access when\\nthe table is traversed by functions like qcom_find_freq() or\\nqcom_find_freq_floor().\\n\\nOnly compile tested.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: qcom: mmcc-apq8084: correcci\\u00f3n de terminaci\\u00f3n de matrices de tablas de frecuencia Se supone que las matrices de tablas de frecuencia terminan con un elemento vac\\u00edo. Agregue dicha entrada al final de las matrices donde falta para evitar un posible acceso fuera de los l\\u00edmites cuando la tabla es atravesada por funciones como qcom_find_freq() o qcom_find_freq_floor(). Solo compilar probado.\"}]",
      "id": "CVE-2024-26966",
      "lastModified": "2024-12-23T13:50:21.860",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-01T06:15:12.913",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-129\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T00:01:02.000Z",
      "cve": "CVE-2024-26966",
      "id": "msrc_CVE-2024-26966",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26966.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26966\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:12.913\",\"lastModified\":\"2026-08-04T11:17:28.197\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\\n\\nThe frequency table arrays are supposed to be terminated with an\\nempty element. Add such entry to the end of the arrays where it\\nis missing in order to avoid possible out-of-bound access when\\nthe table is traversed by functions like qcom_find_freq() or\\nqcom_find_freq_floor().\\n\\nOnly compile tested.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: qcom: mmcc-apq8084: correcci\u00f3n de terminaci\u00f3n de matrices de tablas de frecuencia Se supone que las matrices de tablas de frecuencia terminan con un elemento vac\u00edo. Agregue dicha entrada al final de las matrices donde falta para evitar un posible acceso fuera de los l\u00edmites cuando la tabla es atravesada por funciones como qcom_find_freq() o qcom_find_freq_floor(). Solo compilar probado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clk/qcom/mmcc-apq8084.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"5533686e99b04994d7c4877dc0e4282adc9444a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"a09aecb6cb482de88301c43bf00a6c8726c4d34f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"3aedcf3755c74dafc187eb76acb04e3e6348b1a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"9b4c4546dd61950e80ffdca1bf6925f42b665b03\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"7e5432401536117c316d7f3b21d46b64c1514f38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"5638330150db2cc30b53eed04e481062faa3ece8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\",\"lessThan\":\"a903cfd38d8dee7e754fb89fd1bebed99e28003d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clk/qcom/mmcc-apq8084.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.312\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.274\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.215\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.154\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.84\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:45:23.145806Z\",\"id\":\"CVE-2024-26966\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.17\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"9DAC0B62-D0D6-4AE8-BF57-20A912AADE19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.84\",\"matchCriteriaId\":\"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:08:16+00:00",
      "cve": "CVE-2024-26966",
      "id": "CVE-2024-26966",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26966.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:54:23Z",
      "cve": "CVE-2024-26966",
      "id": "CVE-2024-26966",
      "initial_release_date": "2024-05-03T02:09:46Z",
      "product_status:known_affected": "310",
      "product_status:known_not_affected": "422",
      "product_status:recommended": "531",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26966",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26966.json",
      "version": "72"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.707Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26966\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:45:23.145806Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.675Z\"}}], \"cna\": {\"title\": \"clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is a SoC clock-controller driver reached only through local interfaces \\u2014 V4L2/DRM device nodes whose format and mode requests propagate into clk_set_rate/clk_round_rate, or debugfs. There is no network-facing path to qcom_find_freq().\\nAC:L - The overrun is deterministic: any rate request exceeding the last table entry (466.8 MHz / 320 MHz) walks past the array end every time, with no race to win and no attacker-uncontrollable state. The adjacent .data layout is fixed at build time, so an attacker targeting a known device knows exactly what is read.\\nPR:L - An unprivileged local user with access to the camera or display device nodes (routinely granted to normal apps via the media/graphics groups on Android and embedded builds) can drive a rate request into the affected RCGs through the CLK_SET_RATE_PARENT branch clocks. No root or init-namespace capability is required.\\nUI:N - The rate request is issued synchronously from the attacker\u0027s own ioctl on a device node; no victim action, mount, or file-open by another user is needed.\\nS:U - The out-of-bounds read, the disclosed data, and the misprogrammed clock registers all remain within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The traversal reads an unbounded number of out-of-bounds words from kernel .data, and the value read is returned to the caller as req-\u003erate = f-\u003efreq, observable from userspace via clk_round_rate results and debugfs clk_rate. The adjacent memory is the struct clk_rcg2 containing parent_map, freq_tbl, and clkr.hw.init pointers, so kernel pointer values can be disclosed.\\nI:H - The bogus out-of-bounds entry\u0027s src/pre_div/m/n fields are fed to __clk_rcg2_configure_mnd() and written into the RCG control registers, letting the attacker drive the MMSS AXI and OCMEM NoC bus clocks to an unvalidated, out-of-spec configuration that no code path was ever meant to produce.\\nA:H - The loop has no upper bound and can walk off the end of the mapped section, and on the CLK_SET_RATE_PARENT path a garbage entry with n != 0 and m == 0 hits do_div(tmp, f-\u003em), a kernel divide-by-zero oops. Even short of that, programming an out-of-spec rate on the multimedia AXI/NoC bus clock hangs the multimedia subsystem.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"5533686e99b04994d7c4877dc0e4282adc9444a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"a09aecb6cb482de88301c43bf00a6c8726c4d34f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"3aedcf3755c74dafc187eb76acb04e3e6348b1a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"9b4c4546dd61950e80ffdca1bf6925f42b665b03\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"7e5432401536117c316d7f3b21d46b64c1514f38\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"5638330150db2cc30b53eed04e481062faa3ece8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd\", \"lessThan\": \"a903cfd38d8dee7e754fb89fd1bebed99e28003d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/clk/qcom/mmcc-apq8084.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/clk/qcom/mmcc-apq8084.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2\"}, {\"url\": \"https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0\"}, {\"url\": \"https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f\"}, {\"url\": \"https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9\"}, {\"url\": \"https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99\"}, {\"url\": \"https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03\"}, {\"url\": \"https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38\"}, {\"url\": \"https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8\"}, {\"url\": \"https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\\n\\nThe frequency table arrays are supposed to be terminated with an\\nempty element. Add such entry to the end of the arrays where it\\nis missing in order to avoid possible out-of-bound access when\\nthe table is traversed by functions like qcom_find_freq() or\\nqcom_find_freq_floor().\\n\\nOnly compile tested.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:41.926Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26966\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:41.926Z\", \"dateReserved\": \"2024-02-19T14:20:24.201Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:19:36.656Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.