LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57852: firmware: qcom: scm: smc: Handle missing SCM device

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: smc: Handle missing SCM device Commit ca61d6836e6f ("firmware: qcom: scm: fix a NULL-pointer dereference") makes it explicit that qcom_scm_get_tzmem_pool() can return NULL, therefore its users should handle this.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a missing NULL check in Qualcomm secure firmware handling. On affected Qualcomm-based systems, the kernel could mishandle an absent SCM device or trusted-memory pool. The public sources do not provide CVSS, impact detail, or exploitation evidence, so urgency depends on whether your fleet runs the affected kernel paths.

Executive priority

Track and remediate through normal kernel maintenance unless Qualcomm-based Linux devices are business-critical or unstable. Escalate priority for mobile, embedded, edge, or appliance fleets using affected kernels, because kernel faults can affect device availability even without confirmed exploitation.

Technical view

The qcom SCM SMC code assumed qcom_scm_get_tzmem_pool() returned a valid pool. The CVE states that function can return NULL and users must handle it. The fix is in upstream stable commits. Evidence points to a reliability or availability flaw in affected Linux kernel versions using Qualcomm SCM firmware support.

Likely exposure

Exposure is most likely on Linux systems with affected kernel versions and Qualcomm SCM firmware support. Generic servers without Qualcomm SCM hardware paths are less likely to be practically exposed. The source bundle lists Linux 6.12, 6.12.16, 6.13.4, and 6.14 as affected, but version-range semantics are incomplete.

Exploitation context

CISA KEV status is false, and the provided sources cite no public exploitation. The bundle does not describe attack prerequisites, reachable interfaces, privileges, or real-world impact. Treat this as a kernel stability and platform-specific exposure item until vendor advisories clarify severity.

Researcher notes

The public record is sparse: no CVSS, CWE, exploitability details, or precise version-range explanation. The strongest evidence is the kernel fix rationale: callers must handle a NULL return from qcom_scm_get_tzmem_pool(). Validate by code review and vendor patch mapping, not by exploit reproduction.

Mitigation direction

  • Update to a kernel package containing the referenced stable fixes.
  • Check your Linux distribution or device vendor guidance for backported patches.
  • Prioritize Qualcomm-based devices or products using qcom SCM firmware support.
  • Avoid deploying listed affected kernels on relevant Qualcomm platforms until remediated.

Validation and detection

  • Inventory Linux kernel versions across Qualcomm-based systems.
  • Confirm whether qcom SCM firmware support is present and used.
  • Verify the applicable stable fix commit is included or backported.
  • Review kernel crash records for related qcom SCM NULL-pointer failures.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57852 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxca61d6836e6f4442a77762e1074d2706a2a6e578, ca61d6836e6f4442a77762e1074d2706a2a6e578, ca61d6836e6f4442a77762e1074d2706a2a6e578, 3d36e2b1d803f0d1cc674115d295a8f20ddb9268, 6.11.8unaffected
LinuxLinux6.12, 0, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.