CVE-2024-38573

cppc_cpufreq: Fix possible null pointer dereference

State: Published
Severity: 7.5 High
Published: Jun 19, 2024
Updated: May 11, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

cppc_cpufreq: Fix possible null pointer dereference

cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() can return null as 'policy' in some circumstances. Fix this bug by adding null return check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	a28b2bfc099c6b9caa6ef697660408e076a32019 to before 9a185cc5a79ba408e1c73375706630662304f618Affected a28b2bfc099c6b9caa6ef697660408e076a32019 to before 769c4f355b7962895205b86ad35617873feef9a5Affected a28b2bfc099c6b9caa6ef697660408e076a32019 to before f84b9b25d045e67a7eee5e73f21278c8ab06713cAffected a28b2bfc099c6b9caa6ef697660408e076a32019 to before b18daa4ec727c0266de5bfc78e818d168cc4aedfAffected a28b2bfc099c6b9caa6ef697660408e076a32019 to before dfec15222529d22b15e5b0d63572a9e39570cab4Affected a28b2bfc099c6b9caa6ef697660408e076a32019 to before cf7de25878a1f4508c69dc9f6819c21ba177dbfeAffected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.161 through 5.15.Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.8.12 through 6.8.Not affected 6.9.3 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

a28b2bfc099c6b9caa6ef697660408e076a32019 to before 9a185cc5a79ba408e1c73375706630662304f618Affected
a28b2bfc099c6b9caa6ef697660408e076a32019 to before 769c4f355b7962895205b86ad35617873feef9a5Affected
a28b2bfc099c6b9caa6ef697660408e076a32019 to before f84b9b25d045e67a7eee5e73f21278c8ab06713cAffected
a28b2bfc099c6b9caa6ef697660408e076a32019 to before b18daa4ec727c0266de5bfc78e818d168cc4aedfAffected
a28b2bfc099c6b9caa6ef697660408e076a32019 to before dfec15222529d22b15e5b0d63572a9e39570cab4Affected
a28b2bfc099c6b9caa6ef697660408e076a32019 to before cf7de25878a1f4508c69dc9f6819c21ba177dbfeAffected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.161 through 5.15.*Not affected
6.1.93 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.8.12 through 6.8.*Not affected
6.9.3 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.