CVE-2024-26971: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-26971 is a vulnerability discovered in the Linux kernel's Qualcomm Global Clock Controller (GCC) driver for IPQ5018. The issue was identified and disclosed on May 1, 2024, affecting the frequency table arrays in the gcc-ipq5018.c driver. The vulnerability impacts Linux kernel versions 6.6 through 6.6.24, 6.7 through 6.7.12, and 6.8 through 6.8.3 (NVD).

The vulnerability stems from missing terminating elements in frequency table arrays within the gcc-ipq5018.c driver. These arrays are required to have an empty element at their end to prevent out-of-bounds access during table traversal by functions such as qcom_find_freq() or qcom_find_freq_floor(). The issue has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability could lead to out-of-bounds access when traversing frequency table arrays, potentially resulting in system instability or denial of service. The impact is primarily focused on system availability, with no direct effect on confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. It affects specific Qualcomm hardware configurations using the IPQ5018 clock controller driver. The exploitation complexity is considered low, though no known exploits in the wild have been reported (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves adding terminating empty elements to the affected frequency table arrays. Ubuntu has released updates for affected versions, including fixes in linux-aws 6.8.0-1009.9, linux-gcp 6.8.0-1008.9, and other kernel variants (Ubuntu).