CVE-2024-58076: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-58076 affects the Linux kernel's clock controller driver for Qualcomm SM6350 SoC (gcc-sm6350). The vulnerability was discovered in December 2024 and disclosed in March 2025. The issue occurs when a clkrcg2 has a parent but no parentmap defined, which can lead to a NULL pointer dereference when calling clksetrate (Kernel Git).

The vulnerability exists in the gcc-sm6350 driver where two clocks (gccufsphyphyauxclksrc and gccusb30primmockutmiclksrc) were missing their parentmap definitions. When clksetrate is called, this leads to a NULL pointer dereference in the qcomfindsrcindex function, as evidenced by the call trace in the kernel logs (Kernel Git).

The vulnerability can cause a NULL pointer dereference in the kernel, potentially leading to system crashes when attempting to set clock rates on affected devices using the Qualcomm SM6350 SoC (Red Hat CVE).

The issue has been fixed by adding the missing parentmap property for the two affected clocks and un-inlining the parentdata to maintain consistency between parentmap and parentdata. The fix is available in the kernel patch that adds the proper parent_map definitions (Kernel Git).