CVE-2024-26879: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26879 is a vulnerability in the Linux kernel's clock (clk) subsystem, specifically affecting the Meson AXG clock driver. The issue was discovered when some clocks were missing from axg_clk_regmaps, which caused a kernel panic when attempting to read clock information through the debugfs interface (cat /sys/kernel/debug/clk/clk_summary). The vulnerability was disclosed in April 2024 and affects Linux kernel versions from 5.11 up to versions before 5.15.153, 6.1.83, 6.6.23, and 6.7.11 (NVD).

The vulnerability is caused by missing clock entries in the axg_clk_regmaps array, specifically axg_vclk_div1 and axg_vclk2_div1. When attempting to access these missing clock entries, it results in a NULL pointer dereference at virtual address 0x1fc. The issue manifests in the regmap_read function during clock status checks. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a kernel panic when attempting to read clock information through the debugfs interface. This results in a denial of service condition, affecting system availability. The impact is limited to local attacks and requires local user privileges to exploit (NVD).

The vulnerability requires local access and can be triggered by reading the clock summary information through debugfs (cat /sys/kernel/debug/clk/clk_summary). The attack complexity is low, but it requires local user privileges to execute (NVD).

The vulnerability has been fixed by adding the missing clock entries to the axg_clk_regmaps array. The fix was committed to the Linux kernel and is available in versions 5.15.153, 6.1.83, 6.6.23, and 6.7.11 or later. Users should update their kernel to these versions or later to mitigate the vulnerability (Kernel Patch).