Out-of-bounds Read in Linux

CVE-2024-26970

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested.

Vulnerability class: Buffer Overflow

EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2024-26970?
CVE-2024-26970 is a medium-severity vulnerability in Linux, classified under Out-of-bounds Read. CVSS score: 5.5/10. Published 2024-05-01.
How severe is CVE-2024-26970?
Medium severity. CVSS v3 base score is 5.5 out of 10.