Security readout for executives and security teams
Plain-English summary
A missing end marker in Linux frequency tables can make the Qualcomm MSM8974 clock driver read beyond an array. This could expose kernel memory or crash affected devices. Severity is high, but the supplied sources do not demonstrate a working exploit or confirm active exploitation.
Executive priority
Treat as high priority for confirmed MSM8974-based devices exposed to local untrusted code. Promptly inventory and update those systems, while avoiding broad emergency action on unrelated Linux assets. No supplied evidence supports active exploitation, and actual runtime impact remains insufficiently demonstrated.
Technical view
Several mmcc-msm8974 frequency tables lack the empty sentinel expected by qcom_find_freq() and qcom_find_freq_floor(). Traversal can therefore continue out of bounds. Stable fixes add terminating entries. The reported CVSS is 7.3 with a local, low-privilege vector; however, the kernel change was only compile tested.
Likely exposure
Exposure appears limited to Linux systems containing and using the Qualcomm MSM8974 multimedia clock-controller driver. The bundle lists Linux 3.14 and multiple 4.19 through 6.9 releases, but does not express every affected range clearly. Systems without the relevant driver or hardware are unlikely to reach this flaw.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. CVSS describes local, low-complexity access requiring low privileges and no user interaction. Practical reachability, reliability, and impact beyond possible out-of-bounds access remain unproven.
Researcher notes
Research should establish which affected table traversals are reachable on MSM8974 hardware and whether an over-read crosses meaningful kernel memory boundaries. The original fix was only compile tested. Version metadata is imperfect, including a stray "0" and duplicated commit identifiers, so validate affected builds against distribution or device-vendor advisories.
Mitigation direction
- Inventory Linux devices using the Qualcomm MSM8974 multimedia clock-controller driver.
- Apply the distribution or device-vendor kernel update containing the applicable stable fix.
- If no update is available, obtain product-specific mitigation guidance from the vendor.
- Prioritize affected devices that permit local untrusted users, applications, or workloads.
Validation and detection
- Compare running kernel packages and builds with the relevant vendor security advisory.
- Confirm the applicable patch adds empty terminating entries to affected frequency tables.
- Reboot updated devices and verify the patched kernel is active.
- Review kernel logs for clock-driver faults; their absence does not prove the flaw is unreachable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26965 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95CVE reference, Linux
- https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089CVE reference, Linux
- https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060CVE reference, Linux
- https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194CVE reference, Linux
- https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589CVE reference, Linux
- https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362CVE reference, Linux
- https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01fCVE reference, Linux
- https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2CVE reference, Linux
- https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.