Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can crash affected systems when Qualcomm SM6350 display clock code changes a clock rate. It is an availability issue, not a data theft or privilege escalation issue based on the supplied CVSS data. Business urgency is highest for fleets using affected Qualcomm-based devices or Debian kernels carrying the vulnerable code.
Executive priority
Treat as a moderate availability risk. Patch affected Qualcomm-based Linux devices during normal maintenance unless they support critical operations, where outage potential justifies faster scheduling. Do not prioritize above actively exploited or remote code execution vulnerabilities based on current evidence.
Technical view
The vulnerability is a NULL pointer dereference in the Qualcomm dispcc-sm6350 clock driver. A clk_rcg2 entry had parent data but no parent_map, so clk_set_rate can reach qcom_find_src_index and dereference NULL. The upstream fix adds the missing parent_map and keeps parent data and map together.
Likely exposure
Exposure is likely limited to Linux systems that include and use the Qualcomm SM6350 display clock controller code. General Linux server fleets without this hardware path are less likely exposed. Version evidence in the bundle is incomplete, so confirm against vendor kernel advisories and package changelogs.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. The bundle does not indicate CISA KEV listing or active exploitation. No evidence provided supports remote exploitation, confidentiality loss, or integrity loss.
Researcher notes
Focus triage on downstream kernels carrying the SM6350 display clock driver. The supplied data names CWE-476 and CVSS 5.5. The affected-version ranges are not fully clear from the bundle, so validation should rely on exact vendor package versions or backported commit evidence.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Apply Debian LTS kernel updates where Debian systems are affected.
- For embedded fleets, obtain patched BSP or downstream kernel releases from the device vendor.
- If patching is delayed, prioritize monitoring and reboot recovery for affected device classes.
Validation and detection
- Inventory Linux kernel versions and Qualcomm SM6350-based devices.
- Check vendor advisories or changelogs for the dispcc-sm6350 parent_map fix.
- Review kernel logs for NULL dereferences involving qcom_find_src_index or clk_set_rate.
- Verify patched kernels boot and display clock functionality remains stable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-58080 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3daca9050857220726732ad9d4a8512069386f46CVE reference, Linux
- https://git.kernel.org/stable/c/3ad28517385e2821e8e43388d6a0b3e1ba0bc3abCVE reference, Linux
- https://git.kernel.org/stable/c/2dba8d5d423fa5f6f3a687aa6e0da5808f69091bCVE reference, Linux
- https://git.kernel.org/stable/c/a1f15808adfd77268eac7fefce5378ad9fedbfbaCVE reference, Linux
- https://git.kernel.org/stable/c/d4cdb196f182d2fbe336c968228be00d8c3fed05CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.