Riskcovery

CVE-2024-58080

clk: qcom: dispcc-sm6350: Add missing parent_map for a clock

State
Published
Severity
5.5 Medium
Published
Mar 6, 2025
Updated
May 11, 2026
Reserved
Mar 6, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

clk: qcom: dispcc-sm6350: Add missing parent_map for a clock

If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a NULL pointer dereference when calling clk_set_rate like the following:

[ 3.388105] Call trace: [ 3.390664] qcom_find_src_index+0x3c/0x70 (P) [ 3.395301] qcom_find_src_index+0x1c/0x70 (L) [ 3.399934] _freq_tbl_determine_rate+0x48/0x100 [ 3.404753] clk_rcg2_determine_rate+0x1c/0x28 [ 3.409387] clk_core_determine_round_nolock+0x58/0xe4 [ 3.421414] clk_core_round_rate_nolock+0x48/0xfc [ 3.432974] clk_core_round_rate_nolock+0xd0/0xfc [ 3.444483] clk_core_set_rate_nolock+0x8c/0x300 [ 3.455886] clk_set_rate+0x38/0x14c

Add the parent_map property for the clock where it's missing and also un-inline the parent_data as well to keep the matching parent_map and parent_data together.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 837519775f1d3945e3d4019641f7120d58325059 to before 3daca9050857220726732ad9d4a8512069386f46Affected
  • 837519775f1d3945e3d4019641f7120d58325059 to before 3ad28517385e2821e8e43388d6a0b3e1ba0bc3abAffected
  • 837519775f1d3945e3d4019641f7120d58325059 to before 2dba8d5d423fa5f6f3a687aa6e0da5808f69091bAffected
  • 837519775f1d3945e3d4019641f7120d58325059 to before a1f15808adfd77268eac7fefce5378ad9fedbfbaAffected
  • 837519775f1d3945e3d4019641f7120d58325059 to before d4cdb196f182d2fbe336c968228be00d8c3fed05Affected
LinuxLinux
  • 5.18Affected
  • before 5.18Not affected
  • 6.1.129 through 6.1.*Not affected
  • 6.6.78 through 6.6.*Not affected
  • 6.12.14 through 6.12.*Not affected
  • 6.13.3 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.