Security readout for executives and security teams
Plain-English summary
A missing end marker in Linux camera clock frequency tables can make the kernel read beyond intended memory. On affected Qualcomm SC8280XP-based systems, this could cause crashes or expose sensitive data. The published score is 7.3, but the issue requires local, low-privileged access and appears hardware-specific.
Executive priority
Treat this as a prompt, targeted patching priority rather than an enterprise-wide emergency. Focus first on exposed Qualcomm SC8280XP devices with untrusted local users. Broader urgency is reduced by the local-access requirement, hardware-specific component, and absence of cited active exploitation.
Technical view
The camcc-sc8280xp driver omitted empty terminators from frequency-table arrays. Traversal by qcom_find_freq() or qcom_find_freq_floor() could therefore access memory out of bounds. The supplied CVSS vector indicates local access, low privileges, no user interaction, and potentially high confidentiality and availability impact.
Likely exposure
Likely exposure is limited to affected Linux 6.8–6.9-era kernels containing and using the Qualcomm SC8280XP camera clock driver. Systems on other hardware or without this driver are less likely exposed. Confirm exact distribution package status because the supplied version data is not fully explicit.
Exploitation context
The source bundle does not identify known active exploitation, and CVE-2024-26967 is not listed as KEV. Exploitation would require local, low-privileged access according to the CVSS vector. The fix was only compile-tested, and the sources provide no public proof-of-concept or runtime validation evidence.
Researcher notes
The correction adds missing sentinel entries to frequency arrays, preventing traversal beyond their bounds. No CWE is assigned in the supplied record. Impact claims derive from CVSS and the described out-of-bounds condition; the bundle does not establish practical exploitability. Runtime behavior deserves careful vendor validation because the change was only compile-tested.
Mitigation direction
- Apply a vendor-supported kernel update containing the cited upstream stable fix or an approved backport.
- Check the Linux distribution or device vendor advisory for the exact corrected package version.
- Prioritize systems using Qualcomm SC8280XP camera hardware and permitting access by untrusted local users.
Validation and detection
- Inventory kernel versions on Qualcomm SC8280XP systems and compare them with vendor advisories.
- Confirm whether the camcc-sc8280xp driver is present and applicable to deployed hardware.
- Verify the installed kernel includes either cited correction or a documented vendor backport.
- Review kernel logs for unexplained camera clock faults or crashes, without treating absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/93ff48729211dae55df5d216023be4528d29babbCVE reference, Linux
- https://git.kernel.org/stable/c/6a3d70f7802a98e6c28a74f997a264118b9f50cdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.