LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36930: spi: fix null pointer dereference within spi_sync

In the Linux kernel, the following vulnerability has been resolved: spi: fix null pointer dereference within spi_sync If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message(). With function inlining disabled, the call stack might look like this: _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474 spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue from __spi_sync+0x204/0x248 __spi_sync from spi_sync+0x24/0x3c spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd] mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154 _regmap_raw_read from _regmap_bus_read+0x44/0x70 _regmap_bus_read from _regmap_read+0x60/0xd8 _regmap_read from regmap_read+0x3c/0x5c regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78 irq_thread_fn from irq_thread+0x118/0x1f4 irq_thread from kthread+0xd8/0xf4 kthread from ret_from_fork+0x14/0x28 Fix this by also setting message->complete to NULL when the transfer is complete.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-36930 is a Linux kernel reliability flaw in the SPI subsystem. Under specific message-reuse conditions, the kernel can dereference a null pointer and crash. The source bundle does not show evidence of active exploitation, remote attack paths, or data compromise.

Executive priority

Handle through normal kernel patch governance, with faster treatment for embedded, industrial, vehicle, or appliance systems where kernel crashes affect availability. No source evidence supports emergency internet-wide response.

Technical view

The bug occurs when spi_sync() handles a non-empty queue and the same spi_message is reused. message->complete remains set while context is cleared, so spi_finalize_current_message() can invoke a callback that dereferences null. The fix clears message->complete when transfer completes.

Likely exposure

Exposure is most likely on Linux systems using SPI devices or drivers exercising spi_sync() message reuse. The cited stack includes mcp251xfd, but the bundle describes the underlying issue as kernel SPI behavior, not only that driver.

Exploitation context

The bundle provides a kernel crash call stack and stable fix references, but no exploit reports, public weaponization, KEV listing, or remote exploitation evidence. Treat this primarily as a denial-of-service style kernel crash risk unless vendor guidance says more.

Researcher notes

The affected-version data in the bundle is compressed and should be verified against the CVE JSON, kernel stable commits, and distribution backports. The root cause is stale complete callback state after spi_sync transfer completion.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Prioritize SPI-enabled systems, embedded Linux, and CAN/SPI device deployments.
  • Check distribution advisories for backported fixes before relying on version strings.
  • If patching is delayed, review vendor guidance for operational workarounds.

Validation and detection

  • Inventory Linux kernel versions across SPI-capable systems.
  • Compare deployed kernels against vendor advisories and referenced stable commits.
  • Check logs for null pointer dereference traces involving spi_sync or spi_finalize_current_message.
  • Identify loaded SPI-related drivers, including mcp251xfd where applicable.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36930 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxae7d2346dc89ae89a6e0aabe6037591a11e593c0, ae7d2346dc89ae89a6e0aabe6037591a11e593c0, ae7d2346dc89ae89a6e0aabe6037591a11e593c0, ae7d2346dc89ae89a6e0aabe6037591a11e593c0unaffected
LinuxLinux6.0, 0, 6.1.91, 6.6.31, 6.8.10, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.