CVE-2024-26949: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26949 is a vulnerability in the Linux kernel affecting the AMD GPU driver's power management functionality. The issue was discovered when a NULL pointer dereference occurs during power limit retrieval in the drm/amdgpu/pm component. This vulnerability specifically manifests when powerplay_table initialization is skipped under SR-IOV (Single Root I/O Virtualization) case (Kernel Patch).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.5 (Medium), having a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue occurs in the power management code of the AMD GPU driver where the powerplay_table pointer is accessed without proper NULL checking. The vulnerability affects Linux kernel versions up to (excluding) 6.7.12 and versions from (excluding) 6.8 up to (excluding) 6.8.3 (NVD).

The vulnerability can lead to a system crash due to NULL pointer dereference when attempting to get power limit settings on affected AMD GPU configurations, particularly in virtualized environments using SR-IOV. The impact is limited to availability with no direct consequences for confidentiality or integrity (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, requiring no user interaction. The exploit conditions are specifically tied to AMD GPU configurations using SR-IOV virtualization (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves adding proper NULL pointer checks for powerplay_table and setting default lower and upper OD (OverDrive) values when powerplay_table is NULL. The patch has been applied to multiple kernel versions and is available in version 6.7.12 and later, as well as in version 6.8.3 and later (Kernel Patch).