CVE-2024-37021

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The current implementation of the fpga manager in the Linux kernel assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach can lead to a null pointer dereference while attempting to get the manager if the parent device does not have a driver. To address this problem, a module owner pointer is added to the fpga manager struct and used to take the module's refcount. The functions for registering the manager are modified to take an additional owner module parameter and renamed to avoid conflicts.

Recommendations Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider restricting access to the fpga manager functions until the update is applied.