What’s Vulnerable › Vulnerabilities
CVE-2024-35883: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-05-19 · updated 2026-06-17
- Weakness: CWE-476
Description
In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe In function pci1xxxx_spi_probe, there is a potential null pointer that may be caused by a failed memory allocation by the function devm_kzalloc. Hence, a null pointer check needs to be added to prevent null pointer dereferencing later in the code. To fix this issue, spi_bus->spi_int[iter] should be checked. The memory allocated by devm_kzalloc will be automatically released, so just directly return -ENOMEM without worrying about memory leaks.
Affected products
- Linux kernel: from 6.2 before 6.6.26; from 6.7 before 6.8.5; 6.9-rc1, 6.9-rc2 — fixed in 6.6.26, 6.8.5
How to fix
Upgrade to a fixed version: Linux kernel 6.6.26, 6.8.5. Check the vendor advisory for mitigations.
References
- https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e
- https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06
- https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d
- https://git.kernel.org/stable/c/1f886a7bfb3faf4c1021e73f045538008ce7634e
- https://git.kernel.org/stable/c/4b31a226097cf8cc3c9de5e855d97757fdb2bf06
- https://git.kernel.org/stable/c/95e5d9eb26705a9a76d2ef8bcba9ee2e195d653d
Get alerted when CVE-2024-35883 or the next vulnerability affects your stack