CVE-2024-26965

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26965", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.201Z", "datePublished": "2024-05-01T05:19:32.635Z", "dateUpdated": "2026-08-05T11:28:40.872Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:40.872Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-msm8974: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the Qualcomm MMCC clock controller driver, reached only through in-kernel clock-rate requests originating from local device interfaces (DRM/KMS on /dev/dri/card*, V4L2 on /dev/video*, OCMEM). There is no network-facing path to the frequency-table walk.\nAC:L - The out-of-bounds walk is fully deterministic \u2014 any rate request exceeding the table maximum runs off the end, with no race, no timing window, and no dependence on memory layout the attacker cannot influence. The adjacent .data contents are fixed at build and registration time, so the outcome is reproducible on every attempt.\nPR:L - An unprivileged local user with ordinary access to the display or camera/video device nodes (standard for the video/render groups on the Android and embedded MSM8974/MSM8226 devices this driver targets) can drive rate requests through mdss_axi_clk and the *_ocmemnoc branches, which carry CLK_SET_RATE_PARENT into the two unterminated tables. No root or capability is needed.\nUI:N - The clock-rate request is issued by the attacker's own ioctl/modeset activity on the display or video device; no victim action or separate user is involved.\nS:U - The out-of-bounds read, the leaked data, and the resulting misprogrammed clock all remain within the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The loop is an unbounded out-of-bounds read with no length check, walking adjacent .data that contains live kernel pointers (parent_map, freq_tbl, clkr.regmap, clkr.hw.core) in the neighbouring struct clk_rcg2. The OOB entry's freq is propagated to req->rate and surfaces to userspace via clk_round_rate() and the clk_rate debugfs node, disclosing kernel .data and defeating KASLR.\nI:L - The out-of-bounds src, pre_div, m and n values are written into the RCG CFG/M/N/D hardware registers, reprogramming the MMSS AXI / OCMEM NoC bus clock with an unintended source and divider \u2014 a real modification of system state. The values are not attacker-controlled and there is no out-of-bounds write into kernel memory, so this falls short of a full integrity compromise.\nA:H - The global out-of-bounds read triggers a KASAN global-OOB report (fatal under panic_on_warn) and the unterminated walk can run past the end of the section, while programming a garbage source select and divider into the multimedia bus clock can hang the MMSS bus and lock up the SoC."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/qcom/mmcc-msm8974.c"], "versions": [{"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "99740c4791dc8019b0d758c5389ca6d1c0604d95", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "86bf75d9158f511db7530bc82a84b19a5134d089", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "8f562f3b25177c2055b20fd8cf000496f6fa9194", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "537040c257ab4cd0673fbae048f3940c8ea2e589", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "7e9926fef71e514b4a8ea9d11d5a84d52b181362", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "ae99e199037c580b7350bfa3596f447a53bcf01f", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "ca2cf98d46748373e830a13d85d215d64a2d9bf2", "status": "affected", "versionType": "git"}, {"version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/qcom/mmcc-msm8974.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "4.19.312"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.7.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95"}, {"url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089"}, {"url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060"}, {"url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194"}, {"url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589"}, {"url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362"}, {"url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f"}, {"url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2"}, {"url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96"}], "title": "clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26965", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T17:50:48.637005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:04.278Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.666Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.666Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26965", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-28T17:50:48.637005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T17:50:52.466Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the Qualcomm MMCC clock controller driver, reached only through in-kernel clock-rate requests originating from local device interfaces (DRM/KMS on /dev/dri/card*, V4L2 on /dev/video*, OCMEM). There is no network-facing path to the frequency-table walk.\nAC:L - The out-of-bounds walk is fully deterministic \u2014 any rate request exceeding the table maximum runs off the end, with no race, no timing window, and no dependence on memory layout the attacker cannot influence. The adjacent .data contents are fixed at build and registration time, so the outcome is reproducible on every attempt.\nPR:L - An unprivileged local user with ordinary access to the display or camera/video device nodes (standard for the video/render groups on the Android and embedded MSM8974/MSM8226 devices this driver targets) can drive rate requests through mdss_axi_clk and the *_ocmemnoc branches, which carry CLK_SET_RATE_PARENT into the two unterminated tables. No root or capability is needed.\nUI:N - The clock-rate request is issued by the attacker's own ioctl/modeset activity on the display or video device; no victim action or separate user is involved.\nS:U - The out-of-bounds read, the leaked data, and the resulting misprogrammed clock all remain within the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The loop is an unbounded out-of-bounds read with no length check, walking adjacent .data that contains live kernel pointers (parent_map, freq_tbl, clkr.regmap, clkr.hw.core) in the neighbouring struct clk_rcg2. The OOB entry's freq is propagated to req->rate and surfaces to userspace via clk_round_rate() and the clk_rate debugfs node, disclosing kernel .data and defeating KASLR.\nI:L - The out-of-bounds src, pre_div, m and n values are written into the RCG CFG/M/N/D hardware registers, reprogramming the MMSS AXI / OCMEM NoC bus clock with an unintended source and divider \u2014 a real modification of system state. The values are not attacker-controlled and there is no out-of-bounds write into kernel memory, so this falls short of a full integrity compromise.\nA:H - The global out-of-bounds read triggers a KASAN global-OOB report (fatal under panic_on_warn) and the unterminated walk can run past the end of the section, while programming a garbage source select and divider into the multimedia bus clock can hang the MMSS bus and lock up the SoC."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "99740c4791dc8019b0d758c5389ca6d1c0604d95", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "86bf75d9158f511db7530bc82a84b19a5134d089", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "8f562f3b25177c2055b20fd8cf000496f6fa9194", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "537040c257ab4cd0673fbae048f3940c8ea2e589", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "7e9926fef71e514b4a8ea9d11d5a84d52b181362", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "ae99e199037c580b7350bfa3596f447a53bcf01f", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "ca2cf98d46748373e830a13d85d215d64a2d9bf2", "versionType": "git"}, {"status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "versionType": "git"}], "programFiles": ["drivers/clk/qcom/mmcc-msm8974.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"status": "unaffected", "version": "0", "lessThan": "3.14", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.312", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.154", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.84", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.24", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/clk/qcom/mmcc-msm8974.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95"}, {"url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089"}, {"url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060"}, {"url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194"}, {"url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589"}, {"url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362"}, {"url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f"}, {"url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2"}, {"url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-msm8974: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.312", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.154", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.84", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.24", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.12", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.3", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "3.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:40.872Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26965", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:28:40.872Z", "dateReserved": "2024-02-19T14:20:24.201Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-01T05:19:32.635Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clk/qcom/mmcc-msm8974.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "99740c4791dc8019b0d758c5389ca6d1c0604d95", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "86bf75d9158f511db7530bc82a84b19a5134d089", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "8f562f3b25177c2055b20fd8cf000496f6fa9194", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "537040c257ab4cd0673fbae048f3940c8ea2e589", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "7e9926fef71e514b4a8ea9d11d5a84d52b181362", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "ae99e199037c580b7350bfa3596f447a53bcf01f", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "ca2cf98d46748373e830a13d85d215d64a2d9bf2", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}, {"lessThan": "e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "status": "affected", "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clk/qcom/mmcc-msm8974.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E27A7201-7177-4EBE-B0B2-A341402E33FF", "versionEndExcluding": "4.19.312", "versionStartIncluding": "3.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F45A0F3C-C16D-49C4-86D6-D021C3D4B834", "versionEndExcluding": "5.4.274", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5", "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "577E212E-7E95-4A71-9B5C-F1D1A3AFFF46", "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "834D9BD5-42A6-4D74-979E-4D6D93F630FD", "versionEndExcluding": "6.1.84", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8018C1D0-0A5F-48D0-BC72-A2B33FDDA693", "versionEndExcluding": "6.6.24", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53", "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02", "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-msm8974: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: qcom: mmcc-msm8974: correcci\u00f3n de terminaci\u00f3n de matrices de tablas de frecuencia Se supone que las matrices de tablas de frecuencia terminan con un elemento vac\u00edo. Agregue dicha entrada al final de las matrices donde falta para evitar un posible acceso fuera de los l\u00edmites cuando la tabla es atravesada por funciones como qcom_find_freq() o qcom_find_freq_floor(). Solo compilar probado."}], "id": "CVE-2024-26965", "lastModified": "2026-08-04T11:17:27.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26965", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-28T17:50:48.637005Z", "version": "2.0.3"}}]}, "published": "2024-05-01T06:15:12.783", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays", "id": "2278372", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278372"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nclk: qcom: mmcc-msm8974: fix terminating of frequency table arrays\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\nOnly compile tested.", "A vulnerability was found in the Linux Kernel's qcom mmcc-msm8974.c driver, where out-of-bounds access can occur when the frequency table arrays are traversed by functions like qcom_find_freq() or qcom_find_freq_floor() as the arrays are not terminated with an empty element. This can lead to memory corruption or system instability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-26965", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26965\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26965\nhttps://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26965-a43f@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{"created": "2025-07-13T21:07:29.712430+00:00", "updated": "2025-07-13T21:07:29.712484+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}