CVE-2024-50198

iio: light: veml6030: fix IIO device retrieval from embedded device

State: Published
Severity: 5.5 Medium
Published: Nov 8, 2024
Updated: May 11, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: light: veml6030: fix IIO device retrieval from embedded device

The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client.

dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment.

This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before bf3ab8e1c28f10df0823d4ff312f83c952b06a15Affected 7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before 50039aec43a82ad2495f2d0fb0c289c8717b4bb2Affected 7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before bcb90518ccd9e10bf6ab29e31994aab93e4a4361Affected 7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before 2cbb41abae65626736b8b52cf3b9339612c5a86aAffected 7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before 905166531831beb067fffe2bdfc98031ffe89087Affected 7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before c7c44e57750c31de43906d97813273fdffcf7d02Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.228 through 5.10.Not affected 5.15.169 through 5.15.Not affected 6.1.114 through 6.1.Not affected 6.6.58 through 6.6.Not affected 6.11.5 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before bf3ab8e1c28f10df0823d4ff312f83c952b06a15Affected
7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before 50039aec43a82ad2495f2d0fb0c289c8717b4bb2Affected
7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before bcb90518ccd9e10bf6ab29e31994aab93e4a4361Affected
7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before 2cbb41abae65626736b8b52cf3b9339612c5a86aAffected
7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before 905166531831beb067fffe2bdfc98031ffe89087Affected
7b779f573c48e1ad6da1d6ea5f181f3ecd666bf6 to before c7c44e57750c31de43906d97813273fdffcf7d02Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.228 through 5.10.*Not affected
5.15.169 through 5.15.*Not affected
6.1.114 through 6.1.*Not affected
6.6.58 through 6.6.*Not affected
6.11.5 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.