CVE-2024-26784

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal

On unloading of the scmi_perf_domain module got the below splat, when in

the DT provided to the system under test the '#power-domain-cells' property

was missing. Indeed, this particular setup causes the probe to bail out

early without giving any error, which leads to the ->remove() callback gets

to run too, but without all the expected initialized structures in place.

Add a check and bail out early on remove too.

Call trace:

scmi_perf_domain_remove+0x28/0x70 [scmi_perf_domain]

scmi_dev_remove+0x28/0x40 [scmi_core]

device_remove+0x54/0x90

device_release_driver_internal+0x1dc/0x240

driver_detach+0x58/0xa8

bus_remove_driver+0x78/0x108

driver_unregister+0x38/0x70

scmi_driver_unregister+0x28/0x180 [scmi_core]

scmi_perf_domain_driver_exit+0x18/0xb78 [scmi_perf_domain]

__arm64_sys_delete_module+0x1a8/0x2c0

invoke_syscall+0x50/0x128

el

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References