What’s Vulnerable › Vulnerabilities

CVE-2024-56767: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-06 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len input is error, or the atchan->free_descs_list is empty and memory is exhausted. Therefore, add check to avoid this.

Affected products

• Linux kernel: from 4.2 before 6.1.123; from 6.2 before 6.6.69; from 6.7 before 6.12.8; 6.13-rc1, 6.13-rc2, 6.13-rc3, 6.13-rc4 — fixed in 6.1.123, 6.12.8, 6.6.69

How to fix

Upgrade to a fixed version: Linux kernel 6.1.123, 6.12.8, 6.6.69. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3d229600c54e9e0909080ecaf1aab0642aefa5f0
• https://git.kernel.org/stable/c/54376d8d26596f98ed7432a788314bb9154bf3e3
• https://git.kernel.org/stable/c/8d364597de9ce2a5f52714224bfe6c2e7a29b303
• https://git.kernel.org/stable/c/c43ec96e8d34399bd9dab2f2dc316b904892133f
• https://git.kernel.org/stable/c/e658f1c133b854b2ae799147301d82dddb8f3162
• https://git.kernel.org/stable/c/ed1a8aaa344522c0c349ac9042db27ad130ef913
• https://git.kernel.org/stable/c/fdba6d5e455388377ec7e82a5913ddfcc7edd93b
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Get alerted when CVE-2024-56767 or the next vulnerability affects your stack