CVE-2024-50238: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-50238 affects the Linux kernel's Qualcomm QMP USB-C PHY driver. The vulnerability was introduced when commit 413db06c05e7 removed platform device driver data initialization from the qcom-qmp-usb driver while the data was still being used in runtime PM callbacks. This issue was later replicated when creating the qmp-usbc driver (Kernel Patch).

The vulnerability is a NULL pointer dereference that occurs during runtime suspend operations. The issue stems from the removal of driver data initialization despite its continued use in runtime PM callbacks. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a NULL-pointer dereference during runtime suspend operations. However, the impact is limited as runtime PM functionality needs to be manually enabled through sysfs, and apparently, these drivers are not commonly used with runtime PM (Kernel Patch).

The vulnerability has been fixed by restoring the driver data initialization at probe to prevent the NULL-pointer dereference. The fix involves adding 'devsetdrvdata(dev, qmp)' to properly initialize the driver data (Kernel Patch).