CVE-2024-47688

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58

Description A potential null-ptr-deref issue has been resolved in the Linux kernel's driver core. The issue occurs when kasprintf() fails in module add driver(), causing a null pointer dereference in kernfs name hash() due to strlen() being called with a NULL driver name. This can lead to a kernel panic. The issue is fixed by releasing resources based on the exit path sequence.

Recommendations To resolve this issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider disabling the module add driver() function until a patch is available. Restrict access to the vulnerable of fpga region module to minimize the risk of exploitation. Avoid using the driver name parameter in the affected sysfs remove link() API endpoint until the issue is resolved.