LiveActive security incident?Get immediate response
CVE Record

CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") mv88e6xxx_default_mdio_bus() has checked that the return value of list_first_entry() is non-NULL. This appears to be intended to guard against the list chip->mdios being empty. However, it is not the correct check as the implementation of list_first_entry is not designed to return NULL for empty lists. Instead, use list_first_entry_or_null() which does return NULL if the list is empty. Flagged by Smatch. Compile tested only.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-42224 is a Linux kernel bug in the mv88e6xxx DSA networking driver. The code tried to detect an empty internal MDIO bus list incorrectly. The source bundle does not describe practical impact, CVSS severity, or active exploitation, so urgency depends on whether affected kernels and this driver are present.

Executive priority

Do not treat this as confirmed emergency exposure from the provided evidence. Assign normal kernel patch management priority, elevated for network appliances or embedded Linux systems using the affected driver where outages would matter.

Technical view

The flaw is in mv88e6xxx_default_mdio_bus(). After multi-MDIO support, it checked list_first_entry() for NULL, but that API is not meant to return NULL for empty lists. The fix changes the check to list_first_entry_or_null(). The kernel note says Smatch flagged it and the change was compile-tested only.

Likely exposure

Exposure is most plausible on Linux systems running affected kernel versions or branches with the mv88e6xxx DSA driver in use. The bundle lists Linux as affected and provides stable kernel fix commits, but it does not provide distribution-specific reachability, enabled configurations, or product inventories.

Exploitation context

The source bundle does not report public exploitation, proof-of-concept activity, or KEV listing. It also does not describe a remote trigger path. Treat this as a kernel correctness and stability issue unless vendor advisories provide stronger impact evidence.

Researcher notes

Key uncertainty is impact. The fix corrects an empty-list API misuse, but the bundle lacks crash traces, exploitability analysis, or a trigger description. Researchers should focus on reachability of empty chip->mdios states in affected mv88e6xxx configurations and confirm backport coverage.

Mitigation direction

  • Update affected Linux kernels using vendor or stable kernel packages containing the referenced fixes.
  • Check Debian LTS guidance if using Debian long-term support kernels.
  • Prioritize systems where the mv88e6xxx DSA driver is enabled or loaded.
  • Monitor kernel and distribution advisories for impact clarification.
  • Avoid direct wrangler or unrelated deployment assumptions; follow normal kernel change control.

Validation and detection

  • Confirm the running kernel package includes a referenced stable fix commit.
  • Inventory kernels and modules for mv88e6xxx driver presence.
  • Review distribution changelogs for CVE-2024-42224 backports.
  • Validate networking behavior after kernel updates on affected hardware.
  • Track CISA KEV or vendor advisories for exploitation status changes.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-42224 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89, a3c53be55c955b7150cda17874c3fcb4eeb97a89unaffected
LinuxLinux4.11, 0, 4.19.318, 5.4.280, 5.10.222, 5.15.163, 6.1.98, 6.6.39, 6.9.9, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.