CVE-2024-39498: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-39498 is a NULL pointer dereference vulnerability discovered in the Linux kernel's DisplayPort Multi-Stream Transport (MST) functionality, specifically in the drm_dp_add_payload_part2 function. The vulnerability was introduced when commit 5aa1dfcdf0a4 accidentally overwrote commit 54d217406afe, causing a regression in the code (Kernel Patch).

The vulnerability exists in the drm/mst subsystem of the Linux kernel. The issue stems from a regression where a NULL pointer dereference could occur in the drm_dp_add_payload_part2 function. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The fix involves recovering the original NULL fix and removing an unnecessary input parameter 'state' from the drm_dp_add_payload_part2() function (NVD).

The vulnerability can lead to a denial of service condition through a system crash when exploited. The attack requires local access to the system and can affect Linux kernel versions from 6.7 up to (excluding) 6.9.6 (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in various Linux distributions. Ubuntu has released patches for affected versions, including fixes in version 6.8.0-44.44 for Ubuntu 24.04 LTS and other related kernel packages (Ubuntu Security). The fix has been implemented through a kernel patch that removes the unnecessary 'state' parameter and recovers the original NULL pointer fix (Kernel Patch).