CVE-2024-50229

Summary

CVE-2024-50239 is a vulnerability affecting the Linux kernel's qcom-qmp-usb and qmp-usb-legacy drivers. The issue stems from a mistake in commit 413db06c05e7, where the platform device driver data was inadvertently removed during probe initialization. Despite this data still being used in runtime PM callbacks, the drivers were later copied to create qmp-usb-legacy, resulting in a NULL-pointer dereference on runtime suspend. To address this vulnerability, the driver data initialisation at probe has been restored to prevent the NULL-deref issue. However, it appears that no one currently uses runtime PM with these drivers, as it requires manual enabling through sysfs.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.