Critical NULL Pointer Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-41085: In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix no cxl_nvd during pmem region auto-assembling When CXL subsystem is auto-assembling a pmem region during cxl endpoint port probing, always... Affects linux versions < 6.9.8-1. Fixed in 6.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, from servers to embedded systems. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically in the CXL subsystem, which is responsible for managing memory devices in a system. The issue arises during the auto-assembly of persistent memory regions, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the CXL subsystem, specifically during the auto-assembly of a persistent memory region. When the CXL endpoint port is probed, a NULL pointer dereference occurs, resulting in a kernel panic. This vulnerability can lead to system instability and crashes, as it disrupts the normal operation of the kernel. The root cause is the improper sequencing of the registration of the cxl_nvd memory device, which is not available when needed during the probing process. This flaw can be exploited to cause denial of service by crashing the kernel.
How To Fix
Minimum fixed version
6.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk of system crashes due to a NULL pointer dereference in the CXL subsystem. Users are strongly advised to update their kernel to the patched version 6.9.8-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
This vulnerability can lead to a kernel panic, causing system crashes and instability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the patched version 6.9.8-1.
Currently, there are no specific workarounds available. Updating to the patched version is recommended.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41085.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
