CVE-2024-26968: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-26968 affects the Linux kernel's clock framework, specifically the Qualcomm Global Clock Controller driver for IPQ9574. The vulnerability was discovered in early 2024 and affects Linux kernel versions from 6.4 up to (excluding) 6.6.24, from 6.7 up to (excluding) 6.7.12, and from 6.8 up to (excluding) 6.8.3 (NVD).

The vulnerability stems from missing termination elements in frequency table arrays within the gcc-ipq9574 driver. When these arrays are traversed by functions like qcom_find_freq() or qcom_find_freq_floor(), the lack of proper termination could lead to out-of-bounds access. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium), with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could potentially lead to out-of-bounds memory access when traversing frequency table arrays in the affected driver. This could result in a denial of service condition on systems using the Qualcomm IPQ9574 Global Clock Controller (Kernel Patch).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, and no user interaction is required. However, the impact is limited to availability, with no direct impact on confidentiality or integrity (NVD).

The issue has been fixed by adding proper termination elements to the frequency table arrays. Updates are available in various Linux distributions, including Ubuntu 24.04 LTS (linux-image-6.8.0-35.35), and other affected versions. Systems should be updated to the patched versions to mitigate this vulnerability (Ubuntu).