LiveActive security incident?Get immediate response
CVE Record

CVE-2024-38546: drm: vc4: Fix possible null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: drm: vc4: Fix possible null pointer dereference In vc4_hdmi_audio_init() of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2024-38546 is a Linux kernel bug in the VC4 HDMI audio initialization code. A missing NULL check could cause the kernel to dereference a NULL pointer. The public record does not provide CVSS, confirmed impact, or evidence of exploitation.

Executive priority

Low immediate urgency based on available evidence. Schedule remediation through normal Linux kernel maintenance, with higher priority for systems that depend on the VC4 graphics and HDMI audio path.

Technical view

In vc4_hdmi_audio_init(), of_get_address() may return NULL and the returned value was later dereferenced. The Linux kernel fix adds a NULL check. The issue was found by Linux Verification Center using SVACE, and stable kernel commit references are provided.

Likely exposure

Exposure is most likely on Linux systems running affected kernel builds where the VC4 DRM HDMI audio path is present. The source bundle does not identify distributions, hardware models, or configuration prerequisites beyond Linux kernel VC4 code.

Exploitation context

CISA KEV is false, and the provided sources do not claim active exploitation, public exploit code, or weaponized use. Treat this as a patch-management item unless local exposure analysis shows the affected driver path is in use.

Researcher notes

The record lacks CVSS, CWE, exploitation evidence, and detailed impact analysis. The core condition is a NULL return from of_get_address() in vc4_hdmi_audio_init(), fixed by adding a NULL check across stable branches.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable fixes.
  • Use distribution kernel advisories to map fixes to packaged kernel versions.
  • Prioritize systems where VC4 DRM HDMI audio is enabled or relevant.
  • If no packaged fix exists, monitor Linux and distribution guidance.

Validation and detection

  • Inventory Linux kernel versions across potentially affected systems.
  • Check whether VC4 DRM HDMI audio code is present and enabled.
  • Confirm installed kernels include one of the referenced stable fixes or distro backports.
  • Review crash logs for VC4 HDMI audio initialization faults.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-38546 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbb7d78568814a31a11fa14f1479a9fe51f1582ad, bb7d78568814a31a11fa14f1479a9fe51f1582ad, bb7d78568814a31a11fa14f1479a9fe51f1582ad, bb7d78568814a31a11fa14f1479a9fe51f1582ad, bb7d78568814a31a11fa14f1479a9fe51f1582ad, bb7d78568814a31a11fa14f1479a9fe51f1582ad, bb7d78568814a31a11fa14f1479a9fe51f1582adunaffected
LinuxLinux4.12, 0, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9.3, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.