CVE-2024-26942: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the Linux kernel's at803x driver, specifically affecting the at8031_probe function. The vulnerability was identified and fixed in May 2024, impacting Linux kernel versions from 6.8 up to (excluding) 6.8.3 and version 6.9-rc1. The issue arose during the reworking and splitting of the at803x driver, where a NULL dereference bug was introduced when handling PHY device initialization (NVD).

The vulnerability occurs when the priv pointer is referenced before its actual allocation in the at8031_probe function. This premature reference attempts to write to is_1000basex and is_fiber variables for the at8031 device, resulting in writing to an incorrect memory address. The issue was resolved by correctly setting the priv local variable only after at803x_probe is called and properly allocates priv in the phydev struct. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a kernel panic when the at8031_probe function is executed, potentially causing a denial of service condition. This affects system stability and availability, particularly in environments where the at803x PHY driver is utilized (Kernel Patch).

The vulnerability requires local access and low privileges to exploit. The attack complexity is low, but user interaction is not required for exploitation. The scope is unchanged, meaning the impact is limited to the vulnerable component (NVD).

The vulnerability has been fixed in multiple Linux kernel versions, including 6.8.0-35.35 for Ubuntu 24.04 LTS, 6.8.0-1009.9 for AWS systems, and 6.8.0-1008.9 for GCP systems. Users are advised to update their kernel to the patched versions. The fix involves properly initializing the priv pointer after the at803x_probe call (Ubuntu).