CVE-2024-35848

MEDIUM

Linux Kernel < 5.10.217 - Race Condition

Title source: rule

Description

In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device.

Scores

CVSS v3 4.7
EPSS 0.0002
EPSS Percentile 3.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-362
Status published

Affected Products (12)

linux/linux_kernel < 5.10.217
linux/linux_kernel
linux/linux_kernel
linux/linux_kernel
linux/linux_kernel
linux/linux_kernel
debian/debian_linux
linux/Kernel < 5.10.217linux
linux/Kernel < 5.15.159linux
linux/Kernel < 6.1.91linux
linux/Kernel < 6.6.31linux
linux/Kernel < 6.8.9linux

Timeline

Published May 17, 2024
Tracked Since Feb 18, 2026