CVE-2024-57852: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57852 affects the Linux kernel and involves a vulnerability in the firmware Qualcomm SCM (Secure Channel Manager) component. The issue was discovered and disclosed in February 2025, specifically related to handling missing SCM devices in the qcomscmgettzmempool() function. The vulnerability affects the Linux kernel's firmware subsystem, particularly the Qualcomm SCM driver (Kernel Git).

The vulnerability stems from improper handling of NULL pointer returns from qcomscmgettzmempool(). A previous fix (commit ca61d6836e6f) made it explicit that this function can return NULL, requiring proper handling by its users. The issue occurs in the firmware/qcom/qcom_scm-smc.c file where a NULL pointer dereference could happen if the SCM device is missing (Kernel Git).

If exploited, this vulnerability could lead to a NULL pointer dereference in the Linux kernel's Qualcomm SCM driver, potentially causing system crashes or denial of service conditions on affected systems (NVD).

The issue has been patched in the Linux kernel with a fix that adds proper NULL pointer checking before accessing the mempool. The patch adds a condition to return -EINVAL if the mempool is NULL, preventing the potential NULL pointer dereference (Kernel Git).