CVE-2024-50238

Summary

CVE-2024-50238 is a vulnerability affecting the Linux kernel's qcom-qmp-usb driver. The issue was caused by a mistake in commit 413db06c05e7, which removed the initialization of the driver data during probe. However, the data was still being used in runtime PM callbacks, leading to a NULL-pointer dereference on runtime suspend. This vulnerability only affects drivers that manually enable runtime PM. Currently, it seems that no one uses this feature for the affected drivers. The vulnerability has been resolved by restoring the driver data initialization during probe.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.