CVE-2024-46769: spi: intel: Add check devm_kasprintf() returned value

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-18 · updated 2026-06-17
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devm_kasprintf() returned value intel_spi_populate_chip() use devm_kasprintf() to set pdata->name. This can return a NULL pointer on failure but this returned value is not checked.

Affected products

Linux kernel: from 6.9 before 6.10.10; 6.11-rc1, 6.11-rc2, 6.11-rc3, 6.11-rc4, 6.11-rc5, 6.11-rc6 — fixed in 6.10.10

How to fix

Upgrade to a fixed version: Linux kernel 6.10.10. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/2920294686ec23211637998f3ec386dfd3d784a6
https://git.kernel.org/stable/c/6e68abdc5d674f9f4185bf1e1956368d05df4838

Get alerted when CVE-2024-46769 or the next vulnerability affects your stack