CVE-2024-26965: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26965 affects the Linux kernel's clock (clk) subsystem, specifically in the Qualcomm MSM8974 multimedia clock controller (MMCC) driver. The vulnerability was discovered on May 1, 2024, and impacts Linux kernel systems using the affected driver (NVD).

The vulnerability exists in the frequency table arrays implementation within the mmcc-msm8974.c driver. These arrays are supposed to be terminated with an empty element, but this termination was missing, potentially leading to out-of-bounds access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor() (Kernel Commit).

The vulnerability could potentially lead to out-of-bounds memory access when traversing frequency tables in the affected driver. This could result in system instability or potential denial of service conditions (NVD).

The vulnerability has only been compile tested, and there are no known exploits in the wild. The issue requires local access to a system running the affected driver (Kernel Commit).

The issue has been fixed by adding proper terminating entries to the frequency table arrays. Multiple Linux distributions have released patches, including Ubuntu which has fixed it in versions 6.8.0-35.35 for 24.04 LTS, 5.15.0-116.126 for 22.04 LTS, and 5.4.0-189.209 for 20.04 LTS (Ubuntu Security).